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© Electronic monetary system. 

™oCentTa J rtaTS^hSSi id interfacing the transaction devices to the issuing and cor - 
Zondent banks and J interfacing be^een the issuing and correspondent banks themselves; and (5) a 
Saring bank for ba.ancin g the electronic money accounts of the different ,ssu,ng banks (6). 
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Backgr ound of the invention 

The present invention relates to an electronic monetary system for implementing electronic money 
payments as an alternative medium of economic exchange to cash, checks, credit and debit cards, and 

5 electronics fund transfer. The Electronic - Monetary System is a hybrid of currency, check, card payment 
systems and electronic funds transfer systems, possessing many of the benefits of these systems with few 
of their limitations. The system utilizes electronic representations of money which are designed to be 
universally accepted and exchanged as economic value by subscribers of the monetary system. 

Today, approximately 350 billion coin and currency transactions occur between individuals and 

w institutions' every year. The extensive use of coin and currency transactions has limited the automation of 
individual transactions such as purchases, fares, and bank account deposits and withdrawals. Individual 
cash transactions are burdened by the need of having the correct amount or providing change therefor. 
Furthermore, the handling and managing of paper cash and coins is inconvenient, costly and time 
consuming for both individuals and financial institutions alike. 

is Although checks may be written for any specific amount up to the amount available in the account, 

checks have very limited transferability and must be supplied from a physical inventory. Paper -based 
checking systems do not offer sufficient relief from the limitations of cash transactions, sharing many of the 
inconveniences of handling currency while adding the inherent delays associated with processing checks. 
To this end, economic exchange has striven for greater convenience at a lower cost, while also seeking 

20 improved security. 

Automation has achieved some of these qualities for large transactions through computerized electronic 
funds transfer ("EFT") systems. Electronic funds transfer is essentially a process of value exchange 
achieved through the banking system's centralized computer transactions. EFT services are a transfer of 
payments utilizing electronic "checks," which are used primarily by large commercial organizations. 

25 The Automated Clearing House (ACH) and point of sale (POS) systems are examples of electronic 
funds transfer systems that have become used by retail and commercial organizations on a substantial 
basis in recent years. However, the payments made through these types of EFT systems are limited in that 
they cannot be performed outside of the banking system. Moreover, ACH transactions usually cannot be 
performed during off business hours. 

30 Home banking bill payment services are examples of an electronic funds transfer system used by 
individuals to make payments. Currently, home banking initiatives have found few customers. Of the banks 
that have offered services for payments, account transfers and information over the telephone lines using 
personal computers, less than one percent of the bank's customers are using the service. One reason that 
home banking has not been a successful product because the customer cannot deposit and withdraw 

35 money as needed in this type of system. 

Current EFT systems, credit cards, or debit cards, which are used with an on - line system to transfer 
money between accounts, such as between the account of a merchant and that of a customer, cannot 
satisfy the need for an automated transaction system that provides for the transfer of universally accepted 
economic value outside of the banking system. 

40 To implement an automated, yet more convenient transaction system that does not require the banking 
system to intermediate the transfer, and that can dispense some form of economic value, there has been a 
trend towards off-line electronic funds transfer. For example, numerous ideas have been proposed for 
some form of "electronic money" that can be used in cashless payment transactions as alternatives to the 
traditional currency and check types of payment systems. See U.S. Patent No. 4.977,595, entitled 

45 "METHOD AND APPARATUS FOR IMPLEMENTING ELECTRONIC CASH, and U.S. Patent No. 4,305,059, 
entitled "MODULAR FUNDS TRANSFER SYSTEM." 

The more well known techniques include magnetic stripe cards purchased for a given amount and from 
which a prepaid valve can be deducted for specific purposes. Upon exhaustion of the economic valve, the 
cards are thrown away. Other examples include memory cards or so called smart cards which are capable 

so of repetitively storing information representing value that is likewise deducted for specific purposes. 

However, these proposed systems suffer from a failure to recognize fully the significance of bank 
deposits as money, and their necessity to back any form of universally accepted monetary representations 
that may be issued. In the systems disclosed thus far, representations of economic value, whether 
electronic or paper, are issued without the backing of equal valued liabilities as the counterpart to their 

55 assets. 

None of the paperless payment systems that have been proposed so far are comprehensive enough so 
as to implement a multipurpose electronic monetary system that includes not only the automated devices 
that allow subscribers to transfer electronic funds or money between them without any intermediating 
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tom h„t that also encompasses and includes an entire banking system for generating the value 
S eTented ^e^T^ney and for clearing and settling the electronic money accounts of the 
banks and financial institutions involved to maintain a monetary balance with.n the system. 

Thus sScaily there is a need for a system that allows common payor to payee transact-ons w.thout 
the in erm Son U'the banking system, and that gives contro. of the payment ^^^^ 
c rfh ^mnr« a need exists for providing a system of economic exchange that can be used by large 
Ir payments o 9 f any size, that does not Have the limitations of the current EFT 

^ Accordingly, it is an object of the present invention to overcome the aforesaid shores «W PJ^^ 
compete electric monetary system which utilizes electronic money that is interchangeable w.th tradifona. 

^^^^ss an electronic monetary system for providing transactions utilizing 
«i»rtrnnic representations of currency backed by demand deposits in a bank comprising: 
^£^S5T£d e.ectronic representations of currency; teller means for issuing and d.str^buting 
"a!d ellctror representations of currency; transacting means for storing, and for transferr.ng sa.d 
e rctro^pLentations of currency between other transacting means and between sa.d transacting 

^tes^TeZraiso provides an e.ectronic monetary system for providing transactions utilizing 

20 e^SS^^^^TSn-c-on means for storing, and for transferring said e^ronic 
^presentations of credit between other transacting means and between sa.d transacting means and sa,d 

telle FuTe n r S 'the present invention provides for a method of using electronic representations of currency or 
*J£!£££S^ <* credit provided by at least one financial facility having a means for generat.ng 
said SeS on ^ representations, and a teller means for issuing and accepting said e.ectronic represent -ons 
an ^slSg subscribers of said facility, comprising the steps of: generating said electron* ^es-ta^ons 
oT currency backed by demand deposits or generating said electronic representations of cred.t authonza 
iZ^Z^Z**™ and accepting from said subscribers e.ectronic representations of currency 
rcreoTwhUin the issuance and acceptance is performed by said teller means at sa.d f.nanc.al fac Wy, 
and providing said subscribers with a transacting means for accepting said issued electronic representa- 
tions ^currency or credit, and for transferring said electronic representations of currency or cred.t to both 
other subscribers having said transacting means, and to said teller means. 

° %T P Zsent ^o n provides a method of securely transferring economic value .nc.u *ng currency 
and credS among subscribers, among financia. institutions, and between subscribers and financial instrfu 
tions The system provided is a paperless system whereby transactions can be earned out m both an on - 
n^and an otf-le mode between subscribers. The system reduces the cost of centra, e.ectronic funds 
Snsfer systems by off loading much of the payments to off-line devices. The system P^es for 
Expensive electronic transfers to reduce an institution's cost of managing paper cash, checks and corns^ 
FuX. the invention provides a user friendly electronic payment system that may be used rel.ably and 
securely for real time transfers of money between members of the general public, between members of the 
general public and commercial organizations, and between commercial organ.zat.ons. The system may be 
integrated with a wide variety of data processing and data communication systems .nclud.ng currently 
avaLle home banking services, Further, the system can be utilized with electronic money .n the form of 
multiple currencies and in transactions of virtually any size denomination. Further the med.um of econom.c 
exchange provided is fungible, easily transferable, undeniably redeemable, and secure from reuse, du- 
plication, and counterfeiting. „„hi«.,~H 
The foregoing features and advantages of the invention are illustrative of those wh.ch can be achieved 
by the present invention and are not intended to be exhaustive or limiting of the possible advantages which 
can be realized. Thus, these and other features and advantages of the invention will be apparent from the 
description herein or can be learned from practicing the invention, both as embodied herein or as mod.f.ed 
in view of any variations which may be apparent to those skilled in the art. 
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Sum mary of Exemplary Embodiment 

To achieve the foregoing, and other objects, the methods and apparatus of the present invention 
employ a preferred embodiment in the form of an electronic - monetary system having (1) banks or f.nanc.al 
institutions that are coupled to a money generator device for generating and issuing to subscr.b.ng 
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customers electronic money including electronic currency backed by demand deposits and electronic credit 
authorizations; (2) correspondent banks that accept and distribute the electronic money; (3) a plurality of 
transaction devices that are used by subscribers for storing electronic money, for performing money 
transactions with the on-line systems of the participating banks or for exchanging electronic money with 
other like transaction devices in off-line transactions; (4) teller devices, associated with the issuing and 
correspondent banks, for process handling and interfacing the transaction devices to the issuing and 
correspondent banks, and for interfacing between the issuing and correspondent banks themselves; (5) a 
clearing bank for balancing the electronic money accounts of the different issuing banks; (6) a data 
communications network for providing communications services to all components of the system; and (7) a 
security arrangement for maintaining the integrity of the system, and for detecting counterfeiting and 
tampering within the system. 

In the preferred embodiment the functions of the money generating devices, the transaction devices, 
and the teller devices will be performed by a combination of tamper -proof computer hardware and 
application software modules that may be networked together. Information is transmitted in an encrypted 
form to provide security from unauthorized inspection. The electronic money is transmitted with digital 
signatures to provide authentication, and security from modification or counterfeiting. 

The electronic money exchanged by these devices may be an electronic representation of currency or 
credit An important aspect of the electronic currency is that it is the equivalent of bank notes and is 
interchangeable with conventional paper money through claims on deposits in an issuing bank, but can be 
20 withdrawn or deposited both at an issuing bank and at a correspondent bank. However, only the issuing 
banks can generate the electronic currency, and will be liable for its redemption. 

The issuing banks later utilize inter -bank clearing and settling processes to maintain the monetary 
balance in the banking system, as is currently practiced by today's banking industry. 

The electronic money representations are fungible, universally accepted, and undeniably redeemable 
25 from the issuing banks, i.e., they have the characteristics of money transactions. To preserve the integrity of 
the electronic monetary system, each exchange of electronic money includes, along with other information, 
data identifying the monetary unit of the credit or currency, (i.e., dollars, yen, etc.) the amount by unit of 
credit or currency, and the bank issuing the electronic credit or currency, and several digital signatures. 
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30 Summary of The Invention 

In accordance with these and other objects of the invention, a brief summary of the present invention is 
presented. Some simplifications and omissions may be made in the following summary, which is intended 
to highlight and introduce some aspects of the present invention, but not to limit its scope. Detailed 
35 descriptions of a preferred exemplary embodiment adequate to allow those of ordinary skill in the art to 
make and use the inventive concepts will follow in later sections. 

According to a broad aspect of the invention, an electronic monetary system provides for transactions 
utilizing electronic money including electronic currency backed by demand deposits in a bank in lieu of 
cash transactions, and electronic credit authorizations. The invention comprises a money module for 
40 generating the electronic money; a money module for issuing, distributing, and accepting the electronic 
money; and a money module for accepting, storing, and transferring the electronic money between other 
accepting money modules and between the accepting money module and the issuing money module. 

According to a further aspect of the invention, an electronic monetary system is provided for 
implementing and maintaining electronic money which includes electronic currency that is interchangeable 
45 with conventional money through claims on deposits in a bank, and electronic credit authorizations. 

The system includes a plurality of issuing banks; a genorator for creating electronic money; teller 
modules coupled to the generator module, for performing telier transactions and for interfacing with other 
teller modules, such transactions including the accepting and the distributing of the electronic money; a 
security system for providing the overall integrity of the electronic monetary system; a clearing and settling 
so process for balancing the electronic money accounts of the separate issuing banks and for clearing the 
electronic money issued by the issuing banks; and a plurality of transaction modules owned by authorized 
users, for transferring the electronic money between the transaction modules and between the transaction 
modules and the teller modules. 

In accordance with another aspect of the invention, the functions of the generator modules, the 
55 transaction modules, and the teller modules will be performed by a combination of tamper -proof computer 
hardware and application software that may be networked together. 

The electronic money exchanged by these modules, which may be an electronic representation of 
currency backed by demand deposit accounts at the issuing bank or credit authorizations, may be 
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countfai^ectronic money can be removed from circulation as soon as they are discovered. 
RriPflv a Drocess in accordance with the invention comprises the steps of 
(iTpI'idinTa generating modu.e to generate e.ectronic representations of economic vaiue backed by 

%XZ^*^^» ^e generated e.ectronic representations of economic value and to 

for accepting, storing and transferring the 
eltZc "eVesentlns o, economic exchange to other authorized users having the transacts moduie 

° f eC0 " 0miC — 10 ° ther aUth0riZ8d ^ 
^^^^^^^^ representations of economic value in a 
securmanner between the generating module, the teller modu.e and the transacting module. 

Brief Desc ription of the Drawings 

Other objects and advantages of the present invention will become more apparent by the following 
description with reference to accompanying drawings, in which: 
Fiaure 1 is a diagram illustrating general aspects of the invention; 

Figure 2 is a schematic diagram of the operative arrangement of the components, accord.ng to the 

R V gure°3 is a perspective diagram of several embodiments of externa, systems that may house a money 
module, according to the invention. 

Figure 4 is a block form diagram of a transaction money module, according to the invention. 
Figure 5 is a block form diagram of a Teller money module, according to the h™*™- 
Figure 6 is a block form diagram of a Money Generator module, accord.ng to the invention. 
Figure 7 is a block diagram of the network arrangement, according to the invention. 
Figure 8 is a block diagram of a Network Sever, according to the invent.on. 
Fiaure 9 is a flow diagram of the security system, according to the invention. 
Figure 10 is a block form diagram of a security server, according to the invention 
Fiaures 1 1 - 24 are flow diagrams of accounting examples, according to the invention. 
Figure 25 a flow diagram of the Transaction Reconciliation System, according to the invention. 
Fiaure 26 is a flow diagram of the Clearing System, according to the invention. 
fZe 27 is a flow diagram of the Money Issued Reconciliation System, according to the invention. 
Figures 28 - 50A are flow charts of transaction examples, according to the invention. 

40 Disclosure of the Preferred Embodiment of the Invention 

The present invention contemplates an improved monetary system using electronic media to securely 
^nd reliabTv exchange economic value. The system can be implemented by integrating novel data 

which can be imp.emented with the current worldwide banking 
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^Throughout this description, "electronic money" may also be referred to by the abbreviation "E-M." 
AddSfy the \ erm » b ank" is used hereinafter to indicate any banking, financial institution or the hke 

WhiC ^g^ num.* refer to like components, there is disclosed in 

Figure i n 9 b"ock form, broad aspects of the preferred embodiment, .n Fig. 1 the genera, relays ip 
aSong the features of the system is shown. The system includes .ssuing Banks 1 each having a Teller 
Zey module 5 and a Money Generator modu.e 6; Correspondent Banks 2 each having a Telle, ^money 
moduie 5; an e.ectronic money Clearing Bank 3; a Certification Agency 28 and a plurality of Transaction 
monev modules 4 owned by subscribers of the system. ^«,„„„w 
BecTonic notes 11, the media for transferring electronic money, are generated by the Money Generator 
module 6 for an issuing Bank 1. These notes 11 are then transferred by a Teller money modu.e 5 to a 
subscriber utilizing a Transaction money modu.e 4. E.ectronic notes 11 may be representations °f currency 
or credit authorizations. For security reasons, all electronic notes 11 will expire after a preset t,me period. 
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Once expired, the notes 11 must be redeemed at a participating bank for updated ones before they can be 
transferred. 

An Issuing Bank 1 generates and distributes the electronic notes 11, and is liable for their redemption. 
An Issuing Bank 1 performs deposits, withdrawals, payments to loans and inquiries for other money 
modules. 

A Correspondent Bank 2 is a participating bank which distributes electronic money through accounts it 
maintains at Issuing Banks 1, but does not generate any electronic money, and is not liable for its 
redemption. Because it cannot generate any electronic money, the Correspondent Bank 2 in the preferred 
embodiment must make real-time requests of electronic money from an account it maintains at an Issuing 
Bank 1 whenever a subscriber wishes to withdraw electronic money at a Correspondent Bank 2. 

Conversely, a Correspondent Bank 2 deposits all electronic money deposited by subscribers, to the 
accounts the Correspondent Bank 2 holds at Issuing Banks 1. These accounts will be described hereinafter. 
A Correspondent Bank 2, like an Issuing Bank 1, will perform deposits withdrawals, payments to loans and 
bank inquiries. 

Notably, an Issuing Bank 1 may also be a Correspondent Bank 2 for the monetary units that it does not 
generate. For example, an Issuing Bank 1 for electronic dollar notes 11 may be a Correspondent Bank 2 for 
electronic notes 11 of yen, marks, issued by other banks etc. 

It is also important to note that system of the invention can function without correspondent Banks 2. For 
example, a subscriber can eliminate the use of a Correspondent Bank 2 by communicating directly with 
his/her Issuing Bank 1 when making a deposit, withdrawal, etc. Correspondent Banks 2 are included in the 
preferred embodiment for the practical purpose of expanding distribution of the system while reducing the 
risks that are inherent in any banking system, such as the risks caused by the collapse of a bank issuing 
money. 

The Clearing Bank 3 is utilized when more than one bank is issuing electronic money. According to the 
25 invention, it is anticipated that more than one bank will be issuing electronic money. Thus, the Clearing 
Bank 3 is provided to clear the electronic money deposited and to balance accounts it maintains for the 
Issuing Banks 1 . The Clearing Bank 3 maintains demand accounts for each Issuing Bank 1 in the system. 

The Certification Agency 28, is the centerpiece of the system security. It provides a process that 
"certifies" the validity of a money module for a certain period of time by issuing a certificate to each money 
30 module. A money module must have a valid certificate in order to be able to transact with other money 
modules 4, 5, 6. 

Before the certificate expires, it must be updated so that a subscriber can continue to use his/her 
transaction money module 4. This process makes users of the system establish periodic contact with the 
Certification Agency 28. 

35 Periodic contact allows for faster response when tampering with the money modules of the system is 
detected. To this end, the Certification Agency 28 also provides a list of offending or compromised money 
modules to other money modules so that transactions with the bad units may be blocked. 

The components shown in Figure 1 are best understood by referring to the system's operative 
arrangement illustrated in Figure 2. As illustrated in Figure 2, the preferred embodiment provides for 

40 supplements to the current banking systems that include the following additional components: a plurality of 
the Transaction money modules 4, the Teller money modules 5, and the honey Generator modules 6, for 
creating, transferring and storing the electronic notes 11 (money); a Clearing System 13 to balance the 
accounts of banks issuing currency and credit; a security system 21 to maintain the integrity of the 
electronic notes 11; the current banking systems 20; a network 25 (exemplified by the lines interconnecting 

45 modules and systems) to mediate transactions between money modules 4,5,6, the participating banks 1,2,3 
of system 20 and the security system 21; a Transaction Reconciliation system 22 to detect money module 
malfunctions and insider tampering of the system; a Money Issued Reconciliation System 23 to detect 
counterfeiting and reuse of electronic money; and a Money Position System 24 to keep track of the 
electronic money in circulation. 

so Playing mayor role in the preferred embodiment are three classes of "money modules" for creating, 
storing, and transferring the electronic objects that represent economic value. These include the Transaction 
money modules 4, the Teller money modules 5, and the Money Generator modules 6. It is contemplated 
that these money modules 4,5,6 will be a combination of tamper -proof hardware and application software 
that are meant to be components of a larger processing environment. 

55 Referring to the top right-hand side of Figure 2, a Transaction money module 4 containing electronic 

notes 11 stored therein (not shown) may be used to exchange foreign currency or make a payment with 
another Transaction money module 4, using a secure, encrypted protocol either by a telephonic link, or a 
proximate communication link. Because it is contemplated that an electronic note 11 will be fungible, i.e., it 
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can be broken into any desired amount, the amount transacted between the Transact.on money modules 4 
™ v hP of anv amount up to the amount stored in the payor's Transaction money module 4. 

bale's Snsactfon money module 4 that has received the electronic note 11 as a payment may, .n 
h P Y h JZJfP all o°anv amount of the electronic money contained therein to another subscnber's 
^i:™ P^e -V deposit the e.ectronic money into his/her ban, 

aCC °Ts value of the electronic money stored in the Transaction money module 4 may also be redeemed at 
The value of the ' eiecvon c ■ y ^ money by transfemng any 

1^^^^^* money 9 modu,e 5, whereby a teller or an Automated 
TeTr MachTne (ATM"wi.. return an equal amount of paper money. Naturally, it is anticipated that paper 

-^T:;:STr^^~^^ be conjured to ^ ; depos*. 

lotectTto an Issuing 10^0 " pendent Bank 2 P Te.ler money module 5 (thereby providing among 
"herTngs th ^ transactions not avaL.e in current home banking systems). Upon a request to transac 
^a oank tne Teller money module 5 mediates the transactions for the subscnber's bank account as well 

use a Traisac«oT money module 4. For instance, a subscriber may obtain a stand-alone computing 
^ frT^n.TfL-cttan money modu.e 4 and use the device only in off-line peer-to-peer 
Ssactons wi* other devices containing a Transaction money module 4. such as a merchant's ^-cf- 
saTe ^Sminar Of course, the merchant may then transfer the electronic money to another commerce, 
realization to meet its obligations, or it may deposit the electronic money at its own bank. 
^TZ Vei^Z^e^ electronic money deposited at any .ssuing Bank 1 other than the original 
.ssuim Lnk 1 fself will subsequently be settled for value with the original Issuing Bank 1 through the 
SSS and sett L g process performed by the Clearing System 13. .t is anticipated that the clearing 
^^Itt inT o^ocesses wiM be managed by the Clearing Bank 3 (Figure 1). Each Issuing Bank 1 Teller 
SJTSSuffSS aT. the eLronic notes 11 deposited at its bank but issued from other .ssuing Banks 
1 to the Clearing Bank 3 in order to settle for the value posted to their customers accounts. 

to ^Tfi£L. an exchange for foreign currencies, an exchange of paper cash for e.ectronic 
money or an updating of the electronic money occurs, the Money Generator module 6 Rgure 2 creates 
and dfoitallv signs electronic objects having economic value - either currency or credit notes 11 (Figure 1) 
- that a^ to r e sent to the Transaction money modules 4 through the participating bank's Teller money 
moSs 5 in the form of a packet of electronic notes 11. As mentioned above, the electron* currency notes 
5 I are^he equivalent of bank notes that are backed by deposits, and can be traded between Transact.on 

m TuCthe S withdrawa. transaction, the Teller money module 5 and the Transaction ^ 
may establish a communications link using an encrypted protocol to securely transfer the notes 11 from the 
Teller monev module 5 to the Transaction money module 4. 

RecoS o7°he notes 11 generated and conveyed by the Money Generator module 6 are sent o the 
kJtSS Transaction Reco'ci.iation System 22 and an .ssuing Bank's 1 Money J™*"*^ f ™ 
Svstem 23 for maintaining statistical and housekeeping functions. Records of the electron* notes 11 
cleared and settleTat the Clearing Bank 3 are also provided to the Money Issued Reconc.l.at.on System 23 
45 From these" compilations, a financial position of the system can be produced by the Money Pos.t.on 

^D^pancies and malfunctions are reported to the Security System 21 which £^ " 

oroblem money modules to all money modules in the system when they are connected to the Network 25 
By carTyin^ ^Islfa Transaction money module 4 wi.l be inhibited from transacting with other suspect 

50 Jran ^^r^Vo,e^ of the preferred embodiment, there will now follow a more detai,ed 

description of the individual elements and the transactions between them. 

Money modules 

65 Rgure 3 provides several embodiments of external systems or devices for housing money modules. 

In the preferred embodiment, the external system or device will typically contain data display means 
data input means, data processing means, memory storage means, direct connect.on or contactless 
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bidirectional communications means, and the money module packaged in a tamper -proof hous.ng, ail 
interfaced by suitable means for information transfer, such as are well known in the art. 

As will be understood, a money module may be embodied as a modular component of any larger 
processing environment while still performing the same functions. For example, Transaction money modules 
4 may work as coprocessors embedded in personal portable computing devices like the Hewlett-Packard 
95LX, or as co - processors in mainframe computers, workstations, point-of-sale terminals or telephone 
devices (fixed or portable) connected to a network. 

A Teller money module 5 may be embodied as a coprocessor in the bank's financial computer 
systems The Money Generator module 6 could be a separate processing unit networked to the bank a 
co -processor in a general purpose computer, or it may be combined with an Issuing Bank's 1 Teller 
money module 5 in a larger processor. 

Because it is anticipated that a money module will be implemented in a separate processing device, it 
is assumed that corresponding interface circuitry would be provided in the host processing device to 
provide communication between the processing device and the money module. 

Notably all classes of money modules contemplated by the invention may be implemented program 
matically or by direct electrical connection through customized integrated circuits, or a combination of both, 
using any of the methods known in the industry for providing the functions described below w.thout 
departing from the teachings of the invention. Those skilled in the art will appreciate that from the disclosure 
of the invention provided herein, commercial semiconductor integrated circuit technology would suggest 
numerous alternatives for actual implementation of the inventive functions of the money module that would 
still be within the scope of the invention. 

Trans action Money Module 

In one embodiment, the Transaction money module 4 may be imbedded in any computer of any size or 
use like those serving as general purpose computers or work - stations, to provide functions not limited to 
E-M transaction use. This latter application will allow for such uses as real-time, off-line payments 
between personal computing devices, or on-line payments for network services such as information 
retrieval, telephone calls, or for purchasing airline tickets, theater tickets, etc. 

In another embodiment, the Transaction money module 4 may be imbedded in an individual hand -held 
integrated circuit unit, such as a personalized hand -held computer that may be readily earned by an 
individual as though it were a wallet. As an illustration, the device of the preferred embodiment may include 
a keyboard, a pen or stylus, a touch screen or voice recognition circuitry as a data input means, an 
alphanumeric LCD dot matrix display as a display means, an infrared optical transceiver as a contactless 
bidirectional communications means, and an RJ-11 telephone jack coupled to modem circuitry as a 
telephonic communications means. Additionally, the device may also include various electronic processing 
and storage means for providing calculator capabilities, for storage and processing data of the owner, etc. 

It is important to note that the particular design of the external device is not critical to the invention, and 
other technologies suitable for accomplishing the foregoing functions may also be used. For example, an 
LED instead of an LCD display panel may be used; radio, infra red, inductive or capacitive communications 
methods may be used instead of direct connection, optical communications methods may be used; etc. 

In general, it is anticipated that any Transaction money module 4 owned by a subscriber will be 
embodied in a self-contained, tamper -resistant unit that contains components which are difficult to 
access, and thus prevent any person from improperly examining, counterfeiting or modifying any of its 
contents or arrangements. For example, integrated semiconductor circuits, whose contents are difficult to 
examine, encased in a tamper -resistant package such as that formed by an epoxy or plastic lamination 
may provide a high degree of physical security while providing the necessary storage, computation, timing, 
and other data processing functions. 

However, the invention is not limited to any particular tamper - resistance means, inasmuch as there are 
a number of methods known in the industry for providing such security. Such tamper -resistance will also 
prevent the owner, who can control only some of the internal operations of the Transaction money modules 
4, from certain accesses to thereby provide security from abuse to other relevant institutions and 
individuals. 

Each Transaction money module 4 will have a way of ensuring its own association with a particular 
subscriber, so that its use by other individuals may be limited. In addition to the use of Personalized 
Identification Number (PIN) methods that are well known in the art, the Transaction money module 4 may 
also include means such as a fingerprint reader, voiceprint analyzer, written signature analyzer, or other 
so-called biometrics means, to determine the physical identity of an authorized subscriber. 



8 



BNSDCCID: <EP 0542298A2J_> 



10 



15 



EP 0 542 298 A2 

AHMitinnaih/ the Transaction money module 4 may utilize personalized interactive proofs using ques- 
JSS Z^ZrZ^e able to correct.y answer, such as the owner's ^•™Z"»™ 
Ser favor " e color, etc. Any such techniques may provide additional security for organizations. may 
a rbe to the advantage of the authorized user since such security can protect the from 
fnspeSon and use by someone else coming into possession of the Transact™ money modu to 4^ 

Because the Transaction money module 4 can take on a variety of physical representations, rt wrtl be 
desc^bed by the functions performed in addition to the pertinent physical characters of a preferred 

emb Seierrina now to Fig. 4, a Transaction money module 4 is shown diagrammatically in block torn. 
SpedS a Tran actio' money module 4 has (1) an externa, interface 30 that interfaces the Transaction 
S il 4 to the module's data processing means, the input/output means (human '^rface) and he 
communications circuitry of the external device; (2) a session manager 31 to control and commrt <£. 
finS or It a transaction session; (3) a transactor 32 to manage application functus; and (4) a money 
holder 38 to contain and manage the electronic representations of money. . . 

According to the invention, the following application functions may be implemented m the preferred 

^T^^^^S* Pe*>rms the function of comparing the owner identification char- 
acteSc s such as a user's persona, identification number (P.N) and biometncs character, st,c <e.g 
finae c It voiceprint etc ) that are stored in the memory of the Transaction money module 4. to those of 
h?Tnd viduaT wh P rrattlpting to gain access to the Transaction money module 4. After the proper 
ownership is verified, the Transaction money module 4 may be activated, and the user ,s aMowed certain 
a^esses to the Transaction money module's 4 stored contents. Messages to the subscnber. and 
subscriber inquiries as to the information contained within the Transaction money module 4 are also 

^^e To?elleTarpSon n 34 ilrfaces the Transaction money module 4 to the Tel.er money modu.es 5 
for Ntfat^^perlorming deposit, withdrawal, loan payment transactions, and bank inquiries w.th such 

Telle Tnrp" y /EXtge 5 app.ication 35 supervises the sending and receiving of electronic notes 11 be = 
Transact ion money m odules 4. managing the process in which the electronic notes 11 are property 
"Sckaged" Z to amount, digital signatures, etc. This application provides that the electronic notes 1 a re 
transferred in a recognized, valid format. Notably, this is the application that allows a money module to 
perform payments a'd foreign exchanges. Without this application in the preferred embod.ment, a 
Transaction money module 4 cannot make a payment to another Transact.on money module 4. 
Transact.cn money 36 jdes the manage ment and overseeing of a log that records 

compet ed Transaction's u ndertaken by the money module. For each completed transfer of electron, money. 

an illustrative Tran Log records: 

(1) the type of transfer (i.e., payment, deposit, foreign exchange, etc.), 

(2) the date of transfer, 

(3) the amount of transfer, 

40 (4) the Issuing Bank 1 identifier 
(5) the note identifier, 

(7) !ne TSofte other money module involved in the transaction, and for deposits, withdrawal and 
loan payments: 
45 (8) the bank account number, 

(9) the bank identifier, and 

(10) the amount of the transaction. 

In the preferred embodiment, every money module will have an identifier. A money module identifier 
may be thought of as the "serial number" of the money module and is never changed. 

It te anticipated that a subscriber may have access to several of the fields of data stored ,n the yen Log 
application, such as histories of the amount date, and type of transfer. Information as to the ex p.rat. on date 
J a certificate may also be accessed by the subscriber so that he/she will be informed as to the need to 
update or revalidate the money module's certificate. 

The Maintain Security application 37 manages a list of money module Identifiers that are known to have 
been ge nerally compromi sed. In particular, this is a list that is distributed to each money module when . 
communicates with the Network 25, and is a list of money modules that have passed an invalid or 
counterfeit electronic note 11 or have performed acts deemed detrimental to the system. 
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When establishing a session between money modules, each money module checks its list of bad 
money modules to see if the other is an offending money module. If the other money module's identifier 
appears on the list, the communication is broken off. 

This application also provides the process for obtaining the certificate unique to the money module, for 
5 synchronizing the internal clock, and for managing the creation of new cryptography keys. 

The Note Directory 39 application performs the function of keeping track of the location, identification 
and valu e of the electro nic notes 11 stored within the money module. A note 11. whether it is an electronic 
currency note or an electronic credit note, is the basic unit of electronic money. It is the electronic object 
representing the economic value, the electronic bits that contain the amount, expiration date, note identifier 
w etc (described in detail below) that gets digitally signed (described below) and encrypted when being 
transferred. Both electronic currency notes 11 and electronic credit notes 11 may be located by the Note 

D ' re The y Note Directory application 39 updates summary totals of the current amount of electronic notes 11 
(both currency and credit), by monetary unit after every transfer. A date -of -expiration, a note identification 

js number and an Issuing Bank identifier is also recorded with the location of each note 11. 

In summary, the Note Directory 39 keeps track of the note identification number, the Issuing Bank 1 
identifier the date - of - expiration of the note 11. the location of the note 11 as stored in the Transaction 
money module 4. and the current amount of the total value of the notes 11 stored for each monetary unit. 
These records are maintained for both electronic currency and electronic credit. For a credit note 11. the 

20 account number of the credit line is also maintained. 

The Notes application 40 manages the storage of the representations of the electronic notes 11 
themselveiTboth currency and credit notes 11. This application also generates the transfers when notes 11 

are to be conveyed. . 

The Packet Manager application 41 manages the construction and formatting of a packet of electronic 
notes 11 that are to be transferred to another money module. For example, the Packet Manager 41 will 
utilize an algorithm so that the least number of electronic notes 11 are used to fulfill the requested amount 
of transfer, with the earliest dated electronic notes 11 being used first. Alternatively, when a packet of notes 
11 is transferred to the receiving money module, the Packet Manager 41 application "disassembles the 
packet, verifying the date and separating the data fields that represent the different electronic notes 11 - 

The formatted packet gets several data fields appended to it when electronic notes 11 are "assembled. 
An identifier data field provides the indicia that identifies it as a packet. Additionally, data fields for the total 
value of the notes 11, the number of notes 11, and the individual locations of the notes 11 are provided. 

The Verifier application 42 verifies that a received packet contains valid electronic notes 11 before a 
receiving"n^n¥y module accepts them. The Verifier 42 also checks that the total amount received is equal 
to the sum of the electronic notes 11 that are to be transferred. If the total amount and the individual 
electronic notes 11 are valid, an acknowledgment is returned to allow for completion of the transfer. 
Otherwise, an "invalid" message is sent, and the transfer may be aborted. 

Services applications that are provided fall under two categories: Clock/Timer 43 and Cryptography. The 
Clock/Timer 43 provides output pulses for controlling a transaction timeout, such as the time between the 
40 sending of a message and the return of a corresponding message. 

As will be appreciated, when two money modules are communicating, they may be monitoring a time 
out protocol. For example, after a first money module has sent a message to a second money module, the 
Session Manager 31 of the first money module ("A") may set a timer for a reply if the Transactor 32 
indicates that a reply is required. The Session Manager 31 may also number the message sent. This 
number would appear in the reply message from the Session Manager 31 of the second money module 
( n B n ) 

If the timer expires before the message has been received, then Session Manager A 31 will query 
Session Manager B 31 to determine if the transaction is still running in B. If B does not reply then Session 
Manager A 31 will abort the transaction. If a reply is received that the transaction is proceeding, then the 
timer will be reset to a new time. If A queries B a predetermined number of times without receiving a reply 
to the original message, then A may abort the transaction. 

Separately, this application also maintains the current date and time, both for user display and for 
verifying that an electronic note 11 to be received is not an expired one, along with other general clock 
functions that are commonly used in the industry. 

The Cryptography application contains a Public Key 44 operation, a Symmetric Key 45 operation, and a 
Random Number Generator 46. While the tamper - resistance of the Transaction money module 4 and its 
components makes it difficult for a person to modify the structure of the device or its contents, known 
cryptographic techniques are also employed to provide secure communications and payment transfers 
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Public keTc^ography 44, as is we., known in the art, may be employed by this application to provide 

authl^iicit^ A money module receiving the digitally signed electronic note 11 can ,n turn s.gn and transfer 

thought Tbe inTeasible to decipher and duplicate them within a feasible period of t,me, mak.ng such a 
security system resistant to forgery. 

Lastlv this application also creates new public and private keys when needed. 

SvmLtric Key cryptography 45 provides private key algorithms that are wel. known in the art for 
indi vtduaHessi^ secunty and privacy between money modules. In the preferred embedment th.s 
^cation ^Jtten^i, means in order to secure information being exchanged between 

tW ° ry n we.:kn d o U wn S symmetric key cryptography technique, such as the National Data Enc^ption S tanda rd 
fDEsTsvstem or other cryptography techniques, may be provided in th.s application. For example, due to 
he fnc eaTg interest in priding cryptographically secured communications, manufacturers are Providing 
various semiconductor integrated circuit devices which perform the encryption and decryp ion of data 
Cvlink core-oration's CIDEC data encryption devices are examples of commercially available 
eX P tonZZw«on circuitry that would be suitable in the present invention for this application Due to the 
ZerZmZzSd use of the DES algorithm, devices such as these are wide.y uflized to implement that 

^^mportant to note that the details of the particular cryptographic methodology utilized by the money 
modules are not critical and are not limited to a particular cryptographic technique. 

Ce Random Number Generator 46 generates random like numbers for creating new public private keys 
for t^e ?ublt Key app.icat.on 44 and new private keys for the Symmetric Key 45 app.,cat.on. Th.s 
application is utilized to vary in an unpredictable way the generation rtj^^^ For 

Circuitry for providing such random number generation capab.l.ty are well known in the art. f-or 
instance a ci cuit utilizing a "noisy" diode may provide random values, as is well known in the industry. 
Random number may also be provided by a pseudorandom number generator circuit which .mp.ements ^a 
mathematical algorithm, such as the power - residue algorithm, that generates W*™ X * 
from a "seed" number. The use of clocks or counters provides another often used source of andom , data^ 
As win be understood, the Random Number Generator 46 may use techniques that are well known to a 
person of ordinary skill in the art to generate the temporary numbers, and thus need not be further 

d6S< it ri should be further understood that the foregoing functions disclosed herein may tej>er<or™6by 
known programming techniques and/or dedicated hardware and in some cases may be combination of both 
or shared resources from each. As may be appreciated by a person skilled in the art, ™2^lon Z 
and detail can be made in dependance on specific application requ.rements w.thout departmg from the 
essential features of the money modules. 

Tel ler money module 

The banking systems 20 of both the .ssuing Banks 1 and the Correspondent Banks 2 interface to the 
system of the invention through a Teller money module 5. The Teller money module 5 may be urn edded hn 
any general purpose computer or workstation. The particular design of the Teller money module 5, hke the 
Transaction money module 4, may be implemented in readily known programming techn.ques or ded.cated 
computer haTware, or a combination of both. As will be appreciated by a person skil.ed in the art, various 
designs of the Teller money module 5 may be employed to implement the functions described herem_ 

The details of one embodiment of the Teller money module 5 is shown .n block form n Figure 5. The 
Teller money module 5 contains many of the same components and application functions of the Transa ction 
money module 4 described above. Therefore, the identical components will only be repeated b .efly here, 
whTthe distinguishing components will be fully described. It should be noted that the Teller money 
module S, like other money modules of the system, is also contained within a tamper-proof enclosure of 
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the type common in the industry, so as to ensure the necessary security involved. 

The Teller money module 5 contains an External Interface 30, a Session Manager 31, a Transactor 32 
and a Money Holder 38 that perform similar functions to the corresponding components in the Transaction 
money module 4 described above. 

5 Briefly, the External Interface 30 interfaces the Teller money module 5 to other processing and 

communications means within the Teller money module 5 host processor; the Session Manager 31 acts to 
control and commit (i.e., finalize) or abort a transaction session between the Teller money module 5 and 
another money module; the Money Holder 38 manages the storing and retrieval of electronic money; and 
the Transactor 32 manages the application functions of a To Teller 34, the Tran Log Mgr. 36, the Maintain 

70 Security 37, the To Bank 47, a To Money Generator 48, and the To Transaction 49. 

The following list describes in brief, the applications contained in the Teller money module 5 that are 
functionally identical to the applications found in the Transaction money module 4: 

- To Teller 34: Interfaces deposit and withdrawal functions to another Teller money module 5 . 

- Tran Log Mgr. 36: Transaction log manager for recording transaction details. 

is - Maintain Security 37: Manages the list of compromised money modules, applies for certificates, 
synchronizes the clocks, and manages the creation of new digital keys. 

- Note Directory 39: Keeps track of the location, value and identification of notes 11 by monetary unit. 
Summary totals are also maintained. 

- Notes 40: Manages storage for the electronic notes 11 of exchange, and creates the transfers for the 

20 notes 11. r 

- Packet Manager 41: Manages the assembly and dissembly of a packet to be transferred to a different 

money module. 

- Verifier 42: Verifies that a received packet contains valid electronic notes 11. 

- Clock/Timer 43: Controls transaction timeout, expiration of the validity of the electronic notes 11. 
25 expiration of the certificate, and general clock functions. 

- Cryptography 

(i) Public key 44: used for signatures to sign and validate notes 11 and to set up a secure transaction 
session. 

(ii) Symmetric key 45: Controls the security of a transaction session. 

30 (iii) Random number generator 46: Generates random like numbers for new cryptographic keys. 

Some of the distinguishing applications are the To Bank 47 and To Transaction 49 applications. The To 
Bank application 47 provides the interfacing means whereby the Teller money module 5 can perform 
exchanges of data for inquiries and account postings with the on-line systems of a bank. This application 
is also utilized for crosschecking the customer's account number with the accounts and type of transaction 

35 being requested. 

The To Transaction application 49 performs deposits, withdrawals and payments to loans. This 
application operates whenever a Teller money module 5 is transacting with a subscribers Transaction 
money module 4. 

As mentioned above, a Teller money module 5 may be associated with an Issuing Bank 1 or a 
40 Correspondent Bank 2. When Teller money module 5 is associated with a Correspondent Bank 2, it is 
utilized for intermediating deposits, withdrawals, and payments to loan accounts between a Transaction 
money module 4, the Correspondent Bank's 2 on-line systems, and an Teller money module 5 at an 
Issuing Bank 1. 

When operating in an Issuing Bank 1 mode, the Teller money module 5 is used for intermediating 
45 deposits, withdrawals, and payments to loan accounts between other money modules and the Issuing 
Bank's 1 on-line systems. Additionally, when the Teller money module 5 is performing in an Issuing Bank 
1 mode, a To Money Generator application 48 may be employed when requesting new notes 11. 

Basically, the To Money Generator application 48 performs banking functions dealing with requests for 
electronic notes 11. It interfaces an Issuing Bank's 1 Teller money module 5 to a Money Generator Module 
so 6. 

AH of the other elements performed in an Issuing Bank's 1 Teller money module 5 are essentially 
identical to the similarly named components and application functions described above. 



Money Generator Module 



55 



Figure 6 is a block diagram. illustrating the application functions of a Money Generator module 6. Money 
Generator modules 6 provide the mechanism that Issuing Banks 1 utilize to issue electronic money. A 
Money Generator module 6 is also encased in a tamper - resistant package for the same security reasons 
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stated above for other money modules. . 

A Money Generator module 6 generates the electronic money (in the form of ■ sto ctron.c notes J^o be 
described in further detail below), and distributes them to other money modules through the Teller money 
m"d le 5 o anlsuing Bank 1. The Money Generator moduie 6 includes a unique -^'^^^ 
5 other money modules for responding to requests for electronic money. Th.s .s the Money Creator 

^^SeMo^ey Creator application 50 creates and formats the electronic objects representing yalue - 
eitheTcu rncy backed b y demand deposits, or credit authorizations - and digitally signs these "electron.c 
notes 11" usi^g public key cryptography in conjunction with its secret key, so that it may be sent to an 

irregularities off-loads transaction records in the Tran Log to the Transact.on Reconc.liat.on System 22 
and taSs Electronic notes 11 to the Money .ssued Reconci.iation System 23. A of the other 
^plications of the Money Generator module 6 are identical to the s.milarly named appl.cat.ons of the 

75 money modules described above. 

The Network 

According to one embodiment of the invention, the individual components of the present invention may 
comlnicateover a Network 25. as shown in Figure 7. The Network 25 w nk together the Issu.ng Banks 

I Correspondent Banks 2, the Clearing Bank 3 and the Certification Agency 8. 
' Transaction money modules 4 may be coupled to the Network 25 over the te.ephon e exchange or v.. 

special terminal facilities at bank locations (e.g.. additional contactless or cable connect.ons at an ATM 
booS A communication layer will carry transaction requests (e.g.. deposits, ^f^^^^ 

II and new certificates securely across the Network 25. In the preferred embod.rnent. the Netwo J 2 w.» 
also provide directories of financial services, and update the money module clocks and the bad money 
module list of all money modules. , , . ^ „ . 

As will be understood, the Network 25 may use well known data link or communica *™ 
techniques that utilize, for example, telephone lines, fiber-optic land lines, and satellites and that incude 
connective, timing and control software and circuitry for allowing access and transm.tting dig.tal >nformrtori 
The Network 25 may use commercially available protocols and operating techniques such as those set forth 
by the Internationa. Standards Organization ("ISO") for Open Systems Interconnect "f^* ^ard 8 - It is 
important to note that the particular design of the Network 25 is not cnt.cal and su.table technolog.es for 
accomplishing the foregoing data communications functions may be used 

Each entity (Banks 1 and 2, Certifying Agency 28. or Clearing Bank 3) .s also assumed to have an 
individual local network 16. 17. 18 and a gateway to the larger system Network 25. The larger Network , 25 
will provide directory services for the routing of messages to connect to the appropriate local network 16, 
17 18 The local network 16, 17, 18 has the responsibility of routing messages to the correct money 
module or Security Server 27. A Security Server 27 is associated with each participating bank and the 
Certification Agency 28, and is used for implementing the security of the system. 

Figure 7 illustrates the preferred embodiment of the Network 25 generally, ind.cat.ng that money 
modules of any participating bank may be intercoupled to the money modules of other banks and financial 
institutions, or another subscriber's Transaction money module 4 via a commun.cations hnk d.rectly 
connected into switching and processing centers and alternatively connected to a local network 16, 17, 18 
45 at each entity 

A money module need only identify the local network 16, 17, 18 destination (typically a bank 
subnetwork) for the transmission of most messages. The local network 16, 17, 18 will route the message to 
an appropriate money module for establishing a session. Once a session is established, the Network 25 
directs all messages between the two money modules. The Network 25 also controls messages between 
so money modules and Security Servers 27. 

Transaction money modules 4 may communicate over the Network 25 for depos.ts, withdrawals, 
payments to loan accounts, updates or inquiries. The Teller 5 and Money Generator modules 6 w.ll s.gn on 
the Network 25 periodically to update security information. The sign -on will be initiated by the money 
module Session Manager 31. or by the bank Security Server 27 if recertification is required or if there are 
55 changes to the bad money module list. 

A bank services directory may be available to the money modules pr.mar.ly for updating the electron c 
notes 11 and performing foreign exchange. A list of participating banks for either service will be ava.lable 
from the Network 25. 
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in the preferred embodiment, the Network 25 will provide time services to the individual components of 
the present invention. Transaction 4, Teller 5 and Money Generator modules B and Security Server 27 
clocks may be updated from a Network Server 26 in the Network 25 every time that the respect.ve money 
module accesses the Network 25. . 
5 Network Servers 26 may provide the money module services described below, and gateway services to 

the local networks 16, 17, 18. The application functions of the preferred embodiment of the Network Server 
26 are shown in the block diagram of Figure 8. The following application functions are contemplated for the 
Network Sever 26: 

(1) External Interface 56 - a communications layer which interfaces to the Network 25, and 
io (2) Communication Session Manager 57 - manages a communication session between money modules, 
and between a money module and the Security Server 27. 
Application Services are provided by: 

(3) Manage Network Sign - on 58 - controls the money module Network s.gn - on process; 

(4) Synchronized Time/Date 59 - keeps money module Clock/Timer 43 services synchron.zed to a 

^5) S Route m |vlessage 60 - directory services for routing messages, controlling message routing during 
sign - on and during a money module session; and 

(6) Direct to Bank Services 61 - provides information on services provided by participating banks. 
As will be appreciated by one skilled in the art. switching and processing centers that are known in the 
20 industry may be used to enable the networking cooperation between a financial institution and any other 
that is coupled to the same centers. 

Electronic notes 

We turn now to a further description of the elements of the electronic notes 1 1 themselves. 
An electronic currency note 11 representing value is essentially an electronic object created from a 
transaction request (deposit or withdrawal) which is backed by demand deposits at an Issuing Bank 1. At 
various times and in various points of the system, the notes may appear in electrical or magnetic forms or 
as electromagnetic radiation. These notes 11 may be transferred over several transactions just like paper 
money, with the additional property of fungibility that allows the electronic notes 11 to be commuted and 
transferred in amounts less than or equal to the value of the note 11. 

Notes 11 may be split by appending a transfer record to the note 11 and signing the note 11 using the 
private cryptographic key of the money module transferring the note 11. Electronic cred.t notes 11. 
however, can only be transferred once in the preferred embodiment, because it is anticipated that its 
35 receiver must deposit the credit note 11 so that the loan may be realized. 

Credit notes 11, unlike currency notes 11 are drawn on a subscriber's loan account. Each credit note 11 
carries the account number it is drawn on. The account may be a revolving credit or credit line on which the 
note 11 is drawn, operating much in the same way that a check or a credit card account works in today s 
banking industry. Credit notes 11 can represent a part of or all of the credit line of the account. 

In the preferred embodiment, the credit notes 11 can only be transferred to another Transaction money 
module 4 by the owner of the account, and the receiver of a credit note 11 can only deposit it into his or 
her account as currency. From there, the credit note 11 is cleared with the currency at the Clearing Bank 3. 
The subscriber's bank recognizes the loan upon receipt of the cleared credit note 11. 

When credit notes 11 are withdrawn, they do not trigger any accounting transactions in the preferred 
embodiment. Current credit line processing may to be modified to keep track of the amount of the cred.t 
line in the subscriber's Transaction money module 4. Whenever the subscriber communicates with the 
Issuing Bank 1 maintaining the credit line, the amount of the credit line in the Transaction money module 4 
is removed and replaced based on any adjustments to the credit line in the banking system 20. Total credit 
notes 11 plus outstanding loans must be less than or equal to the total amount of the credit line. 

Electronic notes 11 are comprised of three collections of data fields, namely a Body group, a Transfer 
group, and a Signatures and Certificate group. The Body group of data fields includes the following 
information: 

(1) the type of electronic note 11, i.e., whether it is a currency note 11 or a credit note 11; 

(2) the Issuing Bank's 1 identifier; 
55 (3) the monetary unit identifier; 

(4) a Note identifier; 

(5) its date - of - issue; 

(6) its date -of -expiration; 
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(7) the subscriber's account number (used only for credit notes 11); 

(8) the amount or value of the note 11; and 

(9) the Money Generator module 6 identifier. 

( r.^sr^-^^ — 11 was tra - sterred; (provided ,or currency 

Stlistof'tnsfar records that indicate to whom the apportioned note 11 Was transferred from, the 
die S-tnX, the amount transferred and the identification number of the receiver. 
The Signature and Certificates group of data fields includes: 

(1) the digital signature of the Money Generator module 6; 

(2) the Money Generator module 6 certificate; 

(3) a list of payers which contains each payor's signature and certificate; 

(4) the digital signature of the payor; and 

IZeZZ rT e m 3 1° To^TsZlToLs 11 may be rep.aced with, updated ones before they 
exoife TOs ^^secumy Procedure also he.ps to keep offending notes 11 from being c.rculated broadly. 
6XP As w I be understood, every time that a note 11 is transferred to anothe, ^ney^ p ,6^ 
signed transfer record indicating from whom it is transferred ,s appended Thus, the recipient 
electronic note 11 - ~e a ^^gSTX — by a Transaction money 

S^aTthe iw ^r S 7 J. 11 from tryinrj to us. . value 9..™/ «r, *« ^ «-WJ*»™d. » 
S£ copying notes 11 (or use In another money modulo sines the .dentjtiers «ill hot ™». 

Z » f S appreciated. , subscribe, may be able to access certain information about the electronic 

^ISTmT SSSTZ ™"ar,o "sSett intormation on ,h. tota, amour, o, the electronic 
„J? 1?2S£.' tnl moS »i. <J the notes 11. Ihe type o. eleraronic notes 11. i.e.. currency 0, cred,,. 

and the denomination of each note 11. 

System Security 

The security of the system is maintained by the participating banks and the Certification Agency 28 
which Lates and distributes money module certificates. A certificate of a money modufe '"J^SSlolS 
money module's identifier, its public key, a digital signature of a money module s identifier and P^lic key 
TSa^y key (described below), and the version of the certificatory key. The certificate ,. unique in that ,t 

55 " -c^e tans for money modu.es to va.idate each other prior to 

^mT^oZoL, the money module certificate process and second, by distributing a „st of 
bad money module identifiers. 
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In the preferree embodiment, the money module certificate will be initially loaded into the money 
module by the Certification Agency 28. The Certification Agency 28 generates the certificate for each 
money module using a certificatory key (a private key of the Certificate Agency 28). It may be changed 
periodically and distributed under version control processes that are commonly used in the industry. As will 
be appreciated, every money module will store several versions of the certificatory key in order to verify 
certificates created by an older key. Because it is anticipated that certificates will expire over time, it is 
expected that only a few versions need be kept. 

A certificate will only be valid for a limited period of time after its creation. Upon expiration of the 
certificate the money module will not be allowed to transact with other money modules. Any money 
modules discovered to have been tampered with will be limited in the amount of damage that they can do 
to the system since their certificate will not be updated. 

To block offending modules from transacting it is also desirable to have legitimate money modules 
receive the latest list of offending money modules soon after the list is updated. Naturally, this requires that 
Transaction money modules 4 access the Certification Agency 28 on a periodic basis to obtain the latest 
list Placing a time limit on the Transaction money module's 4 ability to transact (in addition to the time limit 
placed on electronic notes 11) will force subscribers to access the Certification Agency 28 through the 
Network 25 on a periodic basis to receive the latest bad money module list along with the a new certificate. 
Advantageously, the period of the certificate validity can be closely monitored and adjusted according to 
security needs. 

The Certification Agency 28 distributes its updated certificatory key and money module certificates on- 
line through the Security Server 27 (see Figure 9). An important component of the system's security is 
provided by Security Servers 27 at the participating banks and Security Servers 27 at the Certification 

AQe Referring now to Figure 10, a block diagram of a preferred embodiment of the Security Server 27 is 
25 shown. It is contemplated that the Security Server 27 at the Certification Agency 28 or on a bank's local 
network 18 will contain the following application functions: 

(1) External Interface 54 - a communications layer for connecting to a bank's local network 18 or the 
Certification Agency's local network 17; 

(2) Session Manager 55 - controls the security aspects of a transaction session; 
30 (3) Create Certificate 50 - certifies a certificate for any of the money modules; 

(4) Create Account Profile 51 - certifies and signs a bank account profile (described in detail 
hereinafter) that allows a Transaction money module 4 to access the subscriber's different bank 

accounts; , .... . 

(5) Distribute Certification Keys 52 -distributes the Certification Agency's 28 list of valid public keys to 

35 the money modules; 

(6) Bad Money Module Control 53 - controls and distributes the list of bad money modules; and 

(7) Services - identical to the cryptographic functions 44, 45, 46 in the money modules described above 
Since certificates will expire over time, money modules will be required to apply for new certificates 

periodically. In order to receive a new certificate, the money module creates a new public key and private 
key. The new public key, the money module identifier and the old certificate are presented to the 
Certification Agency 28 after being digitally signed using the old private key. 

The Certification Agency 28 checks the signature and if it is valid, signs the new public key and 
identifier and sends the certificate to the money module with a future expiration date. The Certification 
Agency's 28 Security Server 27 also distributes a list of bad money modules via the Network 25. Initially, 
each participating bank's Security Server 27 reports the identifiers of money modules which hold notes 11 
invalidly or that are counterfeit. Those identifiers are passed through the Security Servers 27 and are 
compiled by the Certification Agency 28. 

All such identifiers are distributed to the Teller and Money Generator modules 5, 6 respectively. A 
money module will not transact with another money module found on the list of bad money modules. 
Optionally, only those money modules which have demonstrated a flagrant breach of security will be 
distributed to Transaction money modules 4. 

If a Transaction money module 4 is lost or stolen, the subscriber would report it to his/her bank or to the 
Certification Agency 28 so that the money module identifier may be placed on the bad money module list 
to inhibit any further transactions. 

While the security of the system is provided by being able to block a money module from transacting, 
system security is also maintained by providing the expiration date on the electronic notes 11 in addition to 
the money module certificates. 
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• o 11 wilrt he valid only for a limited time period after it is generated. Its 
As mentioned previous* a also be monitored and varied as needed. The 
date-of-exp.rat,on .s a s™"*?* 3 ™™ ^ J ue of tne note 11. Preferably, a large note 11 will 
period of val,d,ty of a note 11 can be va ed by tne $1 , 0 00,000 note may be set to expire five 

J. 11 may be set to expire ane . can deposit or exchange the notes 

::z« 

« assigning it a unique PIN, biometrics or other ^^^^^Z Transaction money module 4 

Sat »To 0 su^ e .? a n Zl » »>e Transaction mona, mad* 4. than ha/sh. - ba par mi «ad 
"^^tSfTJSSSTL fo r 0 o«an Htf- P,N „ M an incident whicn has atiactad 

Transaction money module 4 and the bank account numbers may then be recreated (see Bank 

^TstouwTJ'noted that it is not a requirement for a subscriber to identify himself to the system when he 
♦ „ L * p« !„T a Transaction money module 4. Though the identity of the money module .s contained 
TZT^nlZon theToS of Traction money module 4 can be kept secret, .f the relationship. 
LeaZ STwe couU trace all of the transactions of a subscriber for the period that the relationship can 
ZtnobvateTZ only time a subscriber must reveal his identity is if he/she links the money module to 

-on* mod* * on.y for payments and foreign 
exchange then hShe can keep the relationship secret. As may be appreciated, the subscriber may also 
acaSe a Pluranty of Transaction money modules 4 and, for example, link one to bank accounts and 
maintain the others for anonymous payments. The other Transaction money modules 4 may be loaded with 
notes 11 by exchanges with other money modules or by exchanging for cash notes 11. 

Re placement of Money Module Value 

If a Transaction money module 4 malfunctions or is lost or stolen, it may be possible for the subscriber 
to recoup va ue Z was stored in the money module at the time of the incident. This -o"ld necessitate 
thaUhe subscriber relinquish the option of anonymity for that money module, since upon making a c aim for 
tne lost mVney he/she would have to verify that he/she is the owner of the Transacts money module 4. 

To pTide for the replacement of e,ectronic notes 11. the subscriber may first link his/her ^J^ton 
money module 4 to a bank account or register ownership of the Transaction money module 4 with the 
Cem/caZ Agency 28. After every transaction involving the transfer of electronic notes 11. the subscriber 
co"etTlZ Log, which identifies the counterparty money module identifier and the note .den.fien 
to iL^ens ve non- volatile storage which is removable from the host computing environment. This log 
ma^n^tad by the subscriber when making a claim to replace value. The log may then be compared 
to reconciliation files to determine the true value of the lost electronic money. 
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An alternative to this procedure would be to refresh the money in the Transaction money module 4 
frequently This would mean that the notes 11 in the Transaction money module 4 would be represented by 
transaction records at the Issuing Banks 1. The existence of the notes 11 could be verified by scanning 

ln@se files. 

A third alternative would allow the system to capture a money module's Tran Log when money is 
refreshed. These records would be copied and routed to Issuing Banks 1 for storage on their transaction 
histories. The existence of the notes 11 could then be verified as in the previous alternative. 

Bank Access 

According to one aspect of the invention, a customer's Transaction money module 4 may access 
his/her accounts for deposits, withdrawals, transfers, etc., at any bank participating in the system and in 
particular any bank holding an account with the subscriber. For instance, a typical subscriber may have a 
savings account and a checking account at one of the participating banks, while maintaining a so-called 
money market account at a separate financial institution, and perhaps a credit -line account at a third 
participating bank. It is anticipated that a subscriber's Transaction money module 4 will access his/her 
accounts for deposits, withdrawals, loan payments and inquiries at any bank or financial institution which 
can be accessed through the Network 25. 

If a subscriber has multiple accounts, the subscriber's account relationships with a bank will be stored 
in an account profile in the To Teller 34 application of the Transaction money module 4. The multiple 
accounts can be linked together by the personal account number ("PAN") associated with the individual 

subscriber. , 

The account profile may be created either in person, under the control of a bank subscriber service 
representative at a branch, or over the telephone utilizing a special dialogue. For example, the subscriber 
may identify himself by his PAN and PIN. He may then enter each account number he wishes to access 
from his Transaction money module 4. The account numbers may be verified in the bank's account 
reference files. A cross-reference of accounts to Transaction money modules 4 may be maintained by 
each bank if they so choose. 

The composition of an exemplary account profile may be: 
30 (1) Bank Identifier - - one for each bank; 

(2) Account Numbers; 

(3) Account Types - - e.g., checking, savings, credit; and 

(4) Security Server's 27 signature on the list of accounts. 
It will be understood that the list of account numbers will be digitally signed by the bank Security Server 

27 As a further security measure the account profile may be re - signed with an updated public key on a 
periodic basis. The fundamental access security is provided by the digital signature of the bank's Security 
Server 27. 
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Banking System (Accounting Architecture) 

It is an notable feature of the preferred embodiment, that the method of the system can parallel the 
existing and varying types of accounting methods that exist today. The system of the preferred embodiment 
follows the various types of accounting methods practiced presently in various banks. However, it is 
important to note that unlike the present banking system, in the preferred embodiment of the invention, 
economic value is created on demand. Thus, there is no inventory of cash or checks involved; electronic 
currency from demand deposits an electronic credit are created on a real-time basis. This elimination of a 
paper inventory by using an electronic media of exchange requires certain supplements to the commonly 
practiced accounting techniques to provide the real-time accounting needed. 

Accordingly, the embodiment of the present invention provides an accounting structure to supplement 
those used in the present banking systems 20. The improved accounting arrangement may be utilized to 
monitor the electronic money and each bank's obligation when a financial transaction between a Transaction 
money module 4 and a Teller money module 5 occurs, or when a Clearing Bank 3 performs any clearing 
processes. 

When electronic notes 11 are transferred to or from a Teller money module 5, in most cases accounting 
transactions affecting the records of the banking system 20 are created. Conversely, transfers between 
Transaction money modules 4 do not involve any formal accounting procedures - - they involve only the 
transfer of electronic notes 11. 
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in the system being described, it is anticipated that the foHowing arrangements of accounts are to be 
utilized for each type of bank, categorized under each monetary unit: 

«lTMonry1 S led a Acco"unt: A liability account which ref.ects the money issued but not cleared. 
2 Monev Due Account- An asset account reflecting the money deposited to the bank's accounts. 
( (3) Deposited at C^ing Bank Account: An asset account refecting the baiance of a cieanng account at 

^rSoondent Bank Money Account: A .lability account owned by a Correspondent Bank 2 which is 

- ** - is used to 

handle multiple currency exchanges. 

<3> Foreign E-cnang. Account A ze.o-balancs liability account omM by each bank, wh.ch is used to 

r*n™rT"nTrorr„o-ba,a„co «a«y account o*ned b, eacl, ban*. M I. us*, to 
temporarily maintain electronic money during a financial transaction. 

(l^l^kS^nB Account: A iiabiiity account to net the amount of money cleared for an Issuing 
Bank 1 

The accounts, with their corresponding symbols, are summarized below: 
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Type of Bank 


Account Name 


Type 


Owner 


Symbol 


30 


Issuing 


Money Issue 
Money Due 

Deposited at Clearing Bank 
Correspondent Bank Money 
Money In Transit 
Foreign Exchange 


Liability 

Asset 

Asset 

Liability 

Liability 

Liability 


Issuing 
Issuing 
Issuing 

Correspondent 

Issuing 

Issuing 


Ml 

MD 

DC 

CM 

IT 

FX 


35 


Correspondent 


Deposited at Issuing Bank 
Money Due 
Money In Transit 
Foreign Exchange 


Asset 
Asset 
Liability 
Liability 


Correspondent 
Correspondent 
Correspondent 
Correspondent 


Dl 
MD 
IT 
FX 


40 


Clearing 


Clearing Account 


Liability 


Issuing 


CA 



Transaction processing, for a transaction such as a request for a withdrawal from savings selec s 
a Jl Q Zcesses so that the appropriate accounts may be credited and deb.ted accordingly. It .s 
Tntic pa ed S?ST2cSr2S ^cesses will be using software programs and methods that are well known 
T^Vo* preset availed; inasmuch as any of the programs and methods currency practiced and 
known for prodding the foregoing accounting procedures would be suitable for use ,n the .nvent.on. To 
better understand the accounting processes of the invention, several examples of typed transactions and 

exchanaes receipt o Cleared money, electronic money/cash exchanges, and note 11 updates. Figures 11 - 
14 and 19- 22^ illustrate the accounting flows when a Transaction money module 4 contains notes 11 
that are not involved in the particular transaction that is occurring. The notes 11 that are not part of *e 
SsaSion a e replaced with updated notes as discussed in the security procedures described above^ For 
example whLn a subscriber deposits less electronic money than is stored in his/her Transaction Money 
Modu^4 leaving a ba.ance. the electronic notes 11 representing the balance are then repaced w,th 
electronic notes 11 containing the most up-to-date certificates. This latter case .s indicated .n the 
parenthetical on Figures 20-23 and 28-31. 
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In an example of the accounting arrangements according to the invention (illustrated by Figure 11), if a 
subscriber were to deposit $50.00 out of $100.00 of electronic money contained in his/her Transaction 
money modules 4 at a Correspondent Bank's Teller money module 5 (Step 1), the entire $100 of electronic 
money would be extracted of which $50.00 would first be credited to his/her customer account (herein 
denoted by "A"), the remaining $50.00 would be credited to the Correspondent Bank's In -Transit account, 
and $100 would be debited to the Money Due account at the Correspondent Bank 2. See "IT" and "MD" in 
Figure 11. 

After the $100 of electronic notes 11 is removed, the notes 11 are deposited from the Correspondent 
Teller money module 5 to the Teller money module 5 of an Issuing Bank 1 (Step 2). In accomplishing this 
transfer the Money Due account at the Correspondent Bank 2 is credited $100 while its Deposited at 
Issuing Bank account is debited by $100; the Issuing Bank 1 credits its Correspondent Bank Money account 
by $100 and debits its Money Due account by $100. 

In Step 3, the updated notes 11 are requested. Thus, the Correspondent Bank 2 requests from the 
Issuing Bank 1 the withdrawal of $50 of electronic money containing the most recent certificates from its 
Money Generator module 6. To support this request, $50 is credited to the Deposited at Issuing Bank 
account and $50 is debited from its Money In Transit account. The Issuing Bank 1 then debits $50 from its 
Correspondent Bank Money account and credits $50 to its Money Issued account. 

To complete the transaction, the $50 is then transferred from the Money Generator module 6 to the 
Correspondent Bank's 2 Teller money module 5 through the Issuing Bank's 1 Teller money module 5, and 
finally to the Transaction money module 4 (Steps 4-6). The net result of all of these transactions is that 
$50 remains deposited in the subscriber's account and $50 of newly issued electronic notes 11 are now 
stored in the Transaction money module 4 of the subscriber. 

Alternatively, if a subscriber begins with $50 in his/her Transaction money module 4 and deposits all of 
it, the customer account would be credited $50 and the Money Due account would be debited by $50 (Step 
25 1 of Figure 1 1 ; parenthetical entries). 

When there are only $50 of electronic notes 11 that are removed, the Correspondent Bank 2 credits the 
Money Due account $50 and the Deposited at Issuing Bank account is debited $50 (Step 2, parenthetical 
entries). This money is then deposited at the Issuing Bank 1 for later clearing, wherein the Correspondent 
Bank Money account is credited by $50 and the Money Due account is debited by $50. Because no 
updated electronic notes 11 need be returned in this situation, the deposit and its corresponding accounting 
is completed at Step 2. 

The accounting processes of an electronic money deposit at an Issuing Bank 1 instead of a 
Correspondent Bank involve fewer operational steps, which are illustrated in Figure 12. Using the same 
dollar amounts as in the previous exemplary transaction, when $50 of $100 in electronic money stored in 
the Transaction money module 4 are deposited directly to an Issuing Teller money module (Step 1), $50 
would be credited to the customers account (A). Fifty dollars would simultaneously be credited to the 
Money In Transit account, and $100 would be debited to the Money Due account at the Issuing Bank 1. 

Since the entire $100 stored in the Transaction money module 4 is removed and transferred to the 
Issuing Bank's Teller money module 5, it is necessary to return $50 of updated notes to the Transaction 
money module 4. Accordingly, as shown in Step 2 the Teller money module 5 requests $50 from its Money 
Generator module 6, debiting its Money In Transit account by $50 and crediting its Money Issued account 
by $50. 

In response, $50 is created by the Money Generator module 6 and transferred to the Teller money 
module 5, which in turn transfers this electronic money to the Transaction money module 4 (Step 3-4). 

When only $50 is stored in the Transaction money module 4 and all of it is deposited, the customer's 
account (A) is credited $50, the Money Due account is credited $50, and that is the end of it. See 
parenthetical entries in Step 2 in Figure 12. 

In the case of a withdrawal from a Correspondent Bank (see Figure 13), a withdrawal request of $100 by 
a subscriber using a Transaction money module 4 at a Correspondent Bank 2 will cause the subscriber's 
so account (A) to be debited by $100 and the Correspondent Bank's 2 Money In Transit account to be credited 
by $100 (Step 1). The request for the $100 withdrawal is forwarded to the Issuing Bank 1 from the 
Correspondent Bank 2, and the Correspondent Bank's Deposited at Issuing Bank account is credited by 
$100 while its Money In Transit account is debited by $100 (Step 3). 

Next, the request for $100 is forwarded by the Issuing Bank's 1 Teller money module 5 to the Money 
Generator module 6. Accordingly, the Correspondent Bank Money account gets a $100 debit while the 
Money Issued account gets a $100 credit (Step 4). 

The Money Generator module 6 then creates the $100 of electronic notes 11, and transfers it to the 
Transaction money module 4 via the Issuing Bank's 1 Teller money module 5 and the Correspondent 
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entries). . d wl * h H r awal reauest in Step 3 must be for $150. This 

Bank Money account gets a $150 deb.t ^^Ttf^ ^o^«JLr Module 6 ($150) gets 
parenthetica. entries). As above, the money »^£££ZH and correspondent Bank 2 Teller 
conveyed to the Transaction money module 4 via trie issuing a* 

Issuing account by S100 (Step 1 -2). i-enina Bank's 1 Teller money module 5 to the 

A request for an updated S100 .s then made by the Issu ng Bank s y 
Money Generator module 6. which upon its creator, w, I re urn $100 ; to the ssumg g 

$50 and the Money Due account will be debited $50 Step n Qenerator module 6 . Naturally, the 

The issuing "^^^^^^^L^ b * $150 when the new notes 11 

customer's account ts debited $100. me Money From there, $150 is returned to the 

„ am*, and 3 " 4 > 

Transaction money module 4 via the issuing oanK ^ | SS uinq Bank 1. In this example, a 

Figure 15 illustr ates the case c a oreign ^^^^fr****™ mon ey module 
subscriber wishes to exchange $100 of electronic ™™v d , g jM cause tne , ssuin g 

Generator module 6 (Step 2) amount is now debited by £60 while the Money Issued 

At the Issuing Bank 1, the foreign exchange account is now ae t y Generator module 6 is 
account is credited by £60. The £60 electronic note 11 (Step 3) . The £60 is 

transferred to the Teller money module 5, wh.c , now . ores > ZZe 4 resulting in a net 

then transferred from the Teller money module 5 to the I^ 8 ^ 0 ^^ ^ Teller money mo dule 5, 
balance of £60 in the Transaction money module 4 and $100 remaining 
45 completing the transfer (Step 4). ^ a „„ a n , c in n for £60 at a Correspondent Bank 2 are 

The accounting procedures for a ^^^f^ .^Ls that °ts $100 be used to 

shown in Fig. 16. The TnjnMclK« rnorjsyi ^£Z£>TZ£*. which causes the Correspondent 
-purchase" £60 from the Correspondent Bank s ^le^oney • debjted b $100 

£60 (Step 2). i«.=„ino Bank 1 debits the Correspondent Bank Money 

The corresponding account transaction at the ^ Brt i w 5 issuing Bank's Teller money 
account by £60 and credits the Money Issued account by £6 ^ T^^suing 
modu.e 5 then requests that the Money Generator mo^le 6 create £^60 ^f*^^ m0 Le 5 - 
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a balance of £60 while the Correspondent Bank's 2 Teller money module 5 finishes with a balance of $100 

^Jhe accounting transactions for a withdrawal or deposit of credit notes 11 also involve several 
accounting operations, as shown in Figure 17. When a subscriber wishes to withdraw money from hisftier 
5 credit line (Step 1), the proper credit note 11 is simply transferred from the Money Generator module 6 to 
the Transaction money module 4, reducing the customer's credit line by an equal amount to the amount 
transferred (Steps 2-4). 

Alternatively, when credit notes 11 are deposited by a subscriber's Transact.on money module 4, the 
subscriber's account is increased by the amount deposited, and the Money Due account is debited by an 

10 equal amount (Step 1). 

The accounting operations involving the Issuing Bank's 1 receipt of cleared electronic money w.ll now 
be described. Referring to Figure 18, in this example $100 of electronic money and $100 of credit notes 11 
have been cleared by the Clearing Bank 3 to settle the balances among several Issuing Banks 1. The $100 
of electronic money and the $100 of credit notes are transferred to the proper Issuing Bank 1 (Step 1). 

15 Additionally, $50 of electronic notes 11 that it has issued are also deposited at the Issuing Bank 1. 
Consequently, the Issuing Bank 1 will debit the subscriber's account A by $100, debit the Issuing Bank's 
Money Issued account by $150, credit the Money Due Account by $50 and credit the Issuing Bank's 
Deposited at Clearing Bank account by $200 to complete the transaction. 

Turning now to Fig. 19, an accounting example of an exchange of cash for electronic notes 11 at an 

20 Issuing Bank 1 is shown. In this example, the subscriber wishes to exchange $50 of cash for $50 of 
electronic notes 11 to add to the $100 of electronic notes 11 already stored in his/her Transaction money 

module 4. . . 

In the first transaction, the $50 of cash is deposited at the Issuing Bank 1 which causes the Money In 
Transit account to be credited by $50, while the cash account is debited by $50 (Step 1). 
25 Next the $100 of electronic notes 11 in the Transaction money module 4 is removed, resulting in the 
Money In Transit account being credited by $100. while the Money Due account is debited by $100 (Step 
2) 

The Teller money module 5 will now request $150 of electronic notes 11 from the Money Generator 
module 6 to return $150 of electronic notes 11 to the subscriber (Step 3). Accordingly, the Money In Transit 
30 account is debited by $150 while the Money Issued account is credited by $150. 

The newly generated $150 of electronic notes 11 is then transferred from the Money Generator module 
6 to the Teller money module 5, who in turn transfers the $150 to the subscriber's Transaction money 
module 4 (Step 4-5). The completed transaction leaves the subscriber with $150 of electronic notes 11 and 
the Issuing Bank's Cash account containing a $50 balance. 

Also shown parenthetically in Fig. 19 is the case when the subscriber exchanges $50 of cash for 
electronic notes 11 when there is a zero balance in his/her Transaction money module 4. In Step 1, the $60 
of cash is deposited at the Issuing Bank 1 which causes the Money In Transit account to be credited by 
$50, while the cash account is debited by $50. Since no notes 11 are removed, no accounting is performed 

40 ' n S ln P Step 3, only $50 is requested from the Money Generator module 6, and the Money In Transit 
account is debited by $50 while the Money Issued account is credited by $50. The same transfer between 
money modules occurs as in Steps 4-5 of Fig. 19 described above, using only the $50 that was requested. 
This would leave the subscriber with $50 of electronic notes 11 in lieu of his original $50 of paper money. 

In Fig. 20, an exchange of cash for electronic notes 11 at a Correspondent Bank 2 is shown. This 
example uses the same parameters as in Figure 19, namely, the subscriber has $50 of cash and $100 of 
electronic notes 11 in his Transaction money module 4. 

When the $50 in cash is deposited to the Correspondent Bank 2, its Money In Transit account is 
credited $50 while its Cash account is debited $50 (Step 1). The $100 of electronic notes 11 is then 
transferred from the Transaction money module 4 to the Correspondent Bank 2 which credits its Money In 
so Transit account by $100 and debits its Money Due account by $100 (Step 2). 

From there, the $100 of electronic notes 11 is deposited at the Issuing Bank 1, wherein its Money Due 
account is debited by $100 while its Correspondent Bank Money account is credited by $100 (Step 3). At 
the Correspondent Bank 2, the Deposited at Issuing Bank account is debited by S100 while the Money Due 
account is credited by $100. 

A withdrawal request is then made by the Correspondent Bank 2 for $150 from the Issuing Bank 1 (Step 
4). This request results in the Correspondent Bank 2 debiting its Money In Transit account by $150 and 
crediting its Deposited at Issuing Bank account by $150. 
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through the Correspondent Bank's 2 Teller money 5 Jf ^ ^ , , in his/her Transacti on money 

Alternatively a subscnber having on y $ 0 c ca h< ^ ^ ^ tQ ^ Correspondent 

module 4 is also shown in Fig. 20. As in tne debjted $5Q _ 

Bank 2, its Money In Transit account is cred^ed $50 £brt. Cas ^ ^ . s 

A $50 withdrawal request ,s the .made to ** Issuing Ba , pare nthetica. entry). 

5T£ ITS 2 £ «- . - . -~ - — - 

75 Transaction money module 4. Issuinq Bank 1. Here the 

exchange $50 of the electronic notes 11 for $50 of paper cash. 

7s^r^;Lle^: Tt^Z ***** to be credited by $100 and the Money Due account (at 
the issuing Bank 1) to be debited by ^ dated electronic notes 11 from the Money 
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tL™ rhtl of electronic notes 11 for paper cash at a Correspondent Bank 2 is illustrated in Figure 
22 ^„^3itSrSB« 21 P aShough the subscriber is on.y exchanging $50 of electron 
Set 11 ^/^sTooTelectronic notes 11 are transferred from the subscriber's Transacts money module 4 

40 (Step 1). transferred the Correspondent Bank's 2 Teller money module 5 credits its 

M^ThTn^T^rby^EJ^ debits its Money Due account by $100. This $100 of electronic 

^iVriSSS at^ Issuing Bank 1, ^^^^S^S 0 ' 8 * ^ 
account by $100 while debiting its Deposited at Issuing Bank account by $ 00 (Step 2) 
« At the Issuing Bank 1, $100 is credited to the Correspondent Bank Money account while $100 is 
m to thp Monev Due account The Correspondent Bank 2 now makes a request to withdraw $50 of 
2^n^^r5X B'ank 1 (Step 3). Consequently, the Deposited at Issuing Bank account 
fs rented by $50 while the Money In Transit account at the Correspondent Bank 2 is deb.ted by $50. 

Sw the issuing Bank's 1 Teller money module 5 request $50 from the Money Ge ""^duto 6 and 
HPhiWte Corresoondent Bank Money account by $50 while crediting its Money Issued account by $50 
^™£Z£^££ electronic notes 11 is transferred from the Money Generator -mod* ,6 i through 
Lsufng Bank 1 Teller money module 5 and the Correspondent Bank 2 Teller money modu.e 5, back to the 

^musTS S T same ex^with on.y $50 stored in the Transaction money module 4. w«ch is 
depend at a Correspondent Bank 2. to be exchanged for paper money For ^^^^ 
X- •* ♦ r>r^r\\^r\ <R*;n *nH the Monev Due account is debited $50 (Step 1). me 3>:>u is men 

r 0 s tedby" e ,S CoXo d nd?nt Ba^k 2 to it^count at the .ssuing Bank 1 . At the Correspondent Bank 2^ 
2 Money Due account receives a $50 credit, while the Deposited at Issuing Bank account receives a $50 
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debit. On the Issuing Bank 1 side, it credits the Correspondent Bank Money account by $50 and debits the 
Honey Due account by $50 after receiving the $50 deposit (Step 2). 

* both ..lustrations, fifty dollars of paper cash is then transferred from the ^respondent Bank 2 to the 
subscriber while the Correspondent Bank 2 debits its Money In Trans.t account by $50 and c edits .to cash 
account by $50 (Step 8). The subscriber is now left with $50 of paper cash and, ,n the first illustration, $50 
of electronic notes 11 stored in his/her Transaction money module 4. Hi «^nt issuina Banks 

Figure 23, the accounting process for clearing the electronics money issued by '^B "has been 

is shown This illustration uses an example in which $100 of electrons notes 11 issued by Bank B has been 
deposed at Luing Bank A, and $150 of electronic notes 11 issued by Bank A have been deposited at 

'""in'sJp"" Jssuing Bank A transfers the $100 issued by Bank B to the Clearing Bank 3. .t then credits its 
Money Due account and $100 and debits its Deposited at Clearing Bank account by the same amount In 
Step 2, issuing Bank B deposits the $150 of .ssuing Bank A's money at the Cleanng Bank 3 . , ts Money Due 
account is credited by $150, while its Deposited at Clearing Bank account .s debited $150 

°n sum? $50 is due to Bank B. Accordingiy, $50 gets debited to the Clearing account of Bank A, wh.le 
$50 gets credited to the Clearing account of Bank B (Step 3). 

in Figure 24 the accounting transactions corresponding to updatmg electronic notes 11 .s shown Here 
S100 of electronic notes 11 are stored in a Transaction money module 4 and are transferred to an Issuing 
Bank 1. where° n $10 o is credited to the Money In Transit account and $100 is debited to the Money Due 

3CC OnlSrld dollars of electronic notes 11 are requested from the Money Generator module 6 , fusing 
the Money In Transit account to be debited by $100 while the Money Issued account .s credited I by $100 
Sep 2) With this accomplished, the $100 of electronic notes 11 is transferred from the Money Generator 
module 6 to the Issuing Bank's 1 Teller money module 5. which in turn transfers the money to the 

subscribers Transaction money module 4 (Steps 3-4). 

R econciliation and Clearing Systems 

Referring to Figure 25. the Transaction Reconciliation System 22 is shown. It will b % u " derstood . th H a "^ 
Teller money modules 5, the Money Generator modules 6 and the banking system 20 may Periodically 
oasftrTnTacton records to a Transaction Reconciliation System 22 maintained at each participating ba£ 
T^^mSoh. wil. be analyzed and matched to determine if there is any faulty process occurring in the 

^re^nra'ctirronciliation System 22. which may be embodied in any appelate. ; sized and 
suitably programmed genera, purpose computer but is not so limited, wil. ensure that all Teller ^money 
module 5 transactions with a financial impact, e.g.. deposits, and withdrawals and payments .match the 
appropriate accounting transactions. Any mismatches could indicate incomplete transacts or possible 

1rm ^i^a^ni the money issued by the Money Generator modules 6 also should correspond to 
Teller money module 5 transactions and have the appropriate accounting transactions recorded. Any 
mi matched data may indicate incomp.ete processing or a security breach. ^^t^^ 
transactions may be caused by incomplete transactions or an attempt to tamper with the records of the 

ban TtoJT#e™6 embodiment, these unmatched transactions may then be transferred to an investigation 
system 12 where the causes of the problems may be determined. On-line dialogues may be provided o 
aSTnvestigators to review the mismatches against transaction records and id , determine im^ 
actions to correct the situation, .nvestigators may then take corrective actions by justing accounts 
deactivating faulty Teller money modules 5 and Money Generator modules 6, and notifying subscribers of 

1,16 Attention is now directed to Figure 26. which illustrates the clearing process for handling deposit 
transactions. Correspondent Banks are not involved in this process because subscriber deposrts are 
deposited to their accounts at .ssuing Banks 1 on a rea.-time basis. At Issuing Banks ^P°«* 
aggregated by the Clearing System 13 to consolidate all deposited electronic money (including the deposits 

from Correspondent Banks) for transmission to the Clearing Bank 3. _ 

The Clearing Bank 3 may be implemented in any computer processing facility capable of accom 
modating the .arge number of transactions and corresponding amounts of data which the system , w.M 
typically handle. A high volume mainframe computer, a suitably sized minicomputer system, a number of 
networked work stations having the necessary data processing capabilities or combination of the forego.ng 
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may a.so be used. As wil, be appreciated by a person sk,ed ,„ the art. the parties design of the Cearing 
Bank 3 hardware system is not critical to the ,nve " t '° r ' m , procedures . m one of these 

U is anticipated that issuing Ban £ Issuing Bank 1 to the Cearing Bank 3. 
procedures, eiectron.c ^ ° when transactions are ac.ual.y occurring. Alternative*, an 
" ^ S^Son. being performed during the course of the day for ,ater 

batchprocessing. interbank process^ could <^^^ ^ its electronic money to a deposit 
As shown in Figure 26, an Issu.ng Bank 1 ma V P e "^J transmitted to the Clearing Bank 3. 

ssrjsrsr rrrs^'s ess — ^ . *, 

by the monetary unit for each Issu.ng Bank s 1 aemana ac DroceS ses Any accounts which are 

industry. , * hat ie cleared is sent back to the Money Issued Reconciliation 

issued to the electronic money cleared I at the C, ^ a " n 9 B ^ 3 . electronic mone y deposited at Issuing 

As indicated in Figure 27, the electronic . m °°.^^ 
Banks 1 and ™- transactions 

Reconciliation system 23. The Honey issueo ™£ . d Addit j 0 nally, the Money 

which was not issued or was possibly transferred more „ mvestigators may then determine 

Any unmatched cases -ay indicate • P^ 1 ™^?^ ToSes are being tampered with, 
whether Money Generator modules 6 are not working properly or y 

K^i^-^T?,^ identifiers are a,so sent 

to the Certification Agency 28 for appropriate ^ ^ stem 24 which creates a 

Separately, the Money Issued ™* e !^ ,t is contemo.ated that 

file to be transmitted to the Cleanng Bank 3 to create a c^"""" y f soecified period, typically at 

« ml ''.^^•^JSKSTte'tS monetary "it. The reports - reflect the outstandinrj 

*. H* of «*»n k segment probes. 

Operational Sequences 

diagrams, to transact™ fu«*or» are tM .IMG* 0| pactions are set fort, in the 
under**.** of th. , ope^on <^"°«» ^^TTdLJ aes o, ip ,io„ of the system processes 

therein. 
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Withdrawal From An Issuing Bank 

In Figures 28-35A, a process flowchart of a transaction between a Transaction money module 4 and 
an Teller money module 5 is shown. In this process example, it is assumed that the subscriber is desirous 
of completing a monetary transaction with a participating bank; specifically, a withdrawal of some amount of 
electronic money from his/her account, to be stored in his/her Transaction money module 4. 

The process flow to set up a withdrawal transaction begins at the top of Figure 28. The first flow bock is 
a withdrawal set up between a money module A and a bank's Teller money module B 5, which is described 
further in Figure 29. This process begins with money module A performing a sign -on process that is also 
described in further detail in another figure, specifically Figure 31. 

Subscriber Sign - On 

Referring to the top of Figure 31, the subscriber prompts his/her Transaction money module 4 to 
perform a sign -on function (Step 10). The Session Manager 31 application receives the sign -on message 
(Step 12) and checks to see if the Transaction money module 4 has inhibited subscribers from signing on 
(Step 14). 

Subscriber sign -on may be inhibited if a user makes several unsuccessful attempts to sign -on to the 
Transaction money module 4. For example, the allowable attempts to sign -on may be limited to three, 
such that if a person makes more than three consecutive unsuccessful attempts to sign -on to the 
Transaction money module 4, the Session Manager 31 will prohibit any further sign -on attempts. 
Additionally, this "lock-out" feature may be maintained for any predetermined time period, such as 
twenty -four hours, for example. Such an arrangement will provide security from persons who come into 
possession of the Transaction money module 4 but who are not properly authorized to access it. It should 
be noted that while this type of an arrangement is anticipated in the preferred embodiment of the invention, 
the invention should not be limited as such, since any of the methods known in the industry for providing 
security from unauthorized persons would be suitable for use herein. 

When the sign -on is not inhibited, as will typically be the case, To Subscriber 33 prompts the 
subscriber to enter his/his sign -on characteristics, such as his/her PIN and biometric identifiers (Step 22). 
Inputs from the subscriber are forwarded through the Session Manager 31 to the To Subscriber 33 
application (Steps 24-28), which responds to the characteristics entered and entitles the subscriber to 
operate the Transaction money module 4 if the subscriber's identification characteristics are the correct 
ones when compared to those stored in the memory of the Transaction money module 4 (Steps 30-32). 

If the subscriber's identification characteristics do not match the identifiers stored in memory, the To 
Subscriber 33 application notifies the subscriber of the invalid sign -on condition (Step 34). From there, the 
To Subscriber 33 application checks to see how many times the user has attempted to sign -on (Step 
36), and if the predetermined count has not been reached, the Session Manager 31 is notified (Step 38). 

The Session Manager 31 works in conjunction with the ClockATimer 43 application to set and to monitor 
the time that has elapsed between unsuccessful sign - on attempts (Step 40). In one embodiment, too many 
unsuccessful attempts within the set time period will cause the Session Manager 31 to prohibit any further 
sign -on attempts, effectively shutting down the Transaction money module 4. The Session Manager 31 
notes that the sign on is terminated in Step 42. 

Turning back to Step 14 of Figure 31. assuming that the Transaction money module 4 is inhibited, the 
Session Manager 31 checks to see if the predetermined time period has expired (Step 16). If the 
Transaction money module 4 is still in the prohibited sign -on mode, the To Subscriber 33 sends a 
message to the subscriber that further access to the Transaction money module 4 is prohibited (Steps 18- 
20). The Session Manager 31 notes that the sign -on attempt is terminated, again in step 42. 

Setup Withdrawal 

Turning to Figure 29, when a proper sign -on is accomplished, the To Subscriber A 33 prompts the 
subscriber for the type of transaction that is desired (Step 43). As mentioned previously, it is anticipated 
that a subscriber may transact with any one of a multitude of accounts at several different participating 
banks and financial institutions. 

After selecting the particular bank and account (Step 44), the Transaction money module 4 initiates a 
procedure for communicating with the bank that was selected, by engaging the Network 25. The overall 
program flow now passes to the procedures illustrated by flowcharts in Figure 33. In Figure 33, there is 
shown the data processing and flow for implementing a sign - on to the Network 25. 
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Network Sign -on 

module. ^i^toH thP monev module initiates communication with the 

After the bank thai is .0 be accused it selected, the « 26 begins by 

NeMork 25 under the control of us Sess.on Manager A 31 (Sle ,501 ^ ^ 

requesting the certificate of th. Transaction mone module 4 J A 31 (Step 

module 4 (Step 68 -70). mes js a Transaction money module 4, 

If the Session Manager A that receives me u« „ nnrf ,,inn <SteD 74) If it is a Teller money 

-Z!f^:^ - - - A — 

^notifies the bank's systems 20 that its -cess W . not be 27 sends an updated list of the 

Assuming the certificate validity A, (Step £. Fig. 33A). The 

bad money modules, and a new list of cert ™^ ™* key This information is received by Session 
E£ A *T^." "SKT ^« A S^Scn. which wil, validate ,h. certified key 

- -ass - - -xr : s oT"fr„;= 

warning * , a "^»~ 9 S~rnr.l ' « ^ aPP^A application o, a Teiie, 
money mod* 4 (Steps 86 TO. or M ^ V „.„ ^ „,„ va „ 1ty „, . 

SS^Sti 'STeven me leU So. 9 ., 27. This heips to ensure the Integrity o. the overall 

svstern . u .;„„«,.,» Maintain Security A updates the bad money module list and the 

,„ the case f'^^f^J^^ ifto to recerLd or the certificate has expired (Steps 96 

'^ml^tS, signature o, «re new ee-eate * »», vaNd a, «s sfcge, Steps 66 - 76. Fig. 33. a™ 

On the other hand, a valid signature, r.y , o pssion Manaaer A 31 receives the new 

-TT ? 40 *£%2 Z ZZtt£^££?££» A to again validate th. 

returning the process to Step ur9 o0 me new certificate generated by Transaction money 

Conversely, if th^ Secu ty Server s s^naru messa9e along 

module A proves to be invalid. Fig. 33D. session mar «a attempt to validate the 

with m. •^•^•i^rS^T,^* S- to S P ,ep 66. 
signature on the certificate (SW « , "JTieuritv server 27 to disconnect from the Network 26 (Step 

module 4, get the To Subscriber a « to mqu modu|e g Qf g Money 

SrinrS 2Mi l^™^. Is . rogues, ,. retry ,h. Network 26 

~Z"££ZTZi*Z2~. - - communication , ink into « N™. -d con^ 
a request for retry ot Network 25 access .ill return the procedure back to Step 56. F,g. 33, wherein 
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Maintain Security A will again retrieve the Transaction money module's certificate for the Network Server 

26 ' Back at Step 98, Fig. 33A if the certificate does not need to be recertified or has not expired ^ Session 
Manager A 31 will request the date and time (Step 100) from Clock/Timer A (Step 102, F.g. 33B), and 

5 forward this data to the Network Server 26 (Step 104). 

The Network Server 26 checks the time and date after receiving it (Step 106) and if it .. ^a d 
acceptable predetermined parameter, the Network Server 26 will send the new time and date (Step ,110) to 
Clock/Timer A through Session Manager A (Steps 112 & 114). If Clock/Timer A 43 cannot adjust th -date 
and time to be synchronized with the Network 25, the operator of the money module for subscnber or the 

w bank is notified of the clock malfunction (Step 116 -124). 

In response to the apparent malfunction, the operator may attempt to have the t.me and date resent 
from the Network Server 26, Step 124. and the procedure reverts back to Step 102 m which .t attempts to 
send the new date and time to the money module. Alternatively, an acceptable date and t,me check Step 
108 allows the Network Server 26 and Session Manager A to exchange acknowledgements and note the 

is successful Network 25 sign - on (Step 1 26 - 1 28). 

Establishing A Session 

As shown in Figure 29. after the steps of money module Sign -on. transaction selection and network 
20 sign -on are completed, sessions are established between the money modules. Figure 34 diagrams ; the 
flow process for establishing a money -module to money -module session, wh.ch, as w,H be 
one skilled in the art, will in general be applicable as well to other sessions estabhshed between the vanous 
types of money modules of the present invention. K »~ih«,r u ac 

Referring to the top of Figure 34, the Session Manager A will first check to see .f the subscnber has 
requested connection to a specific destination in the Network 25. (Step 1 90). For inst ance where a 
subscriber is desirous of transacting with his/her account at a specific bank, the Network 25 w.ll connect the 
Transaction money module 4 to the selected bank, Steps 192-198. Conversely, when * subscnber s 
performing updating functions on the Network 25, there is no need to estabhsh a session^ w.th any peafic 
bank, and the Network server 26 may decide where to route the connection, based on Network 25 traffic 

If a specific destination has been selected by the subscriber, Session Manager A conveys the 
destination information to the Network Server 26 (Step 194). The Network Server 26 initiates a commu - 
nication link to the money module of the selected destination (Step 196) and sends an acknowledgement to 

Session Manager A 31. . /c+ „ 

After receiving the acknowledgement that the destination money module has been contacted (Step 
198), the Maintain Security application A will send its certificate to the Maintain Security application B 
throuqh each application's respective Session Manager (Steps 200 - 206). 

It is anticipated that the money modules will exchange certificates to verify that each money module is 
interacting with another valid money module. To this end (as seen in Fig. 34A), the Public Key application B 
44 tests the certificate of money module A by using the public key algorithm and the public key 
corresponding to the private key used by money module A, to encrypt and check A's certificate and verify 
that it is valid (Step 208). . . . , Cton 

If the certificate is found invalid, the session Manager B will note the session is terminated (Step 2 0). 
In the case of a Transaction money module 4. the To Subscriber B informs the subscriber of the transaction 
termination (Setup 212). Likewise, a Teller money module 5 of Money Generator Module 6, uses the To 
Bank application B 47 to notify the bank of the termination. Step 213. It is anticipated that the counterparty 
money module will then timeout to end the exchange. ..... o 

In Step 214 Fig. 34A, assuming that the certificate of money module A is valid, the Maintain Security 
application B 37 checks to see if Transaction money module A is on the list of compromised money 
modules (Step 213). If money module A is on that list, the process flow returns to Step 210 so that the 

so communications can be terminated. c,„h~™ 

Alternatively, when money module A is not on the list of compromised money modules, then Random 
Number Generator B 46 creates a session key (Step 216) and encodes the session key along with money 
module B's certificate and a verification message, using money module A's public key (Step 218). Tn.s 
encoded message is sent to money module A by Session Manager B 31 (Step 220). 
5S Session Manager A 31 receives the message from money module B (Step 222), and uses .ts Public 
Key 44 algorithms application to decode the message (Step 224, Fig. 34B), and to verify money module Bs 
certificate (Step 226). 
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transaction- <"^^T^T^ "communication session and to functional shut off money 
SSK r™^™!— H ending. <S,eps =00-524. Figure 32). 



Abort Transaction 



process ~™ m ^ d ^" Jto Jma y errnin.t.ng th. tactions occurring between thorn. According!,. 
Z rnoTntodlf S ST £S£d "X- and Y" to il.uswte the generic applicability o. the process 

-X. a- transaction 

„ ^ V JStl^^™ X il^ ««* ana then'otmg ,ha, th. session has Peon 
^n^c^wLe th. money mod* that is initiating the termination is a Transaction money module 4, 
« ^uoTriptr application L «y ^ £ ^^TST SEE ^Iny 

- ^ng%hCsT.^^ « - - ~ — ' 

module f nds an enco™^ _ 6y „ 

Bnefly refernng to Figure 37. all en ™", ™„ » . . x -, uses lts Symmetric Key 45 to 

tailoring steps. The ^ "^^"S. .1» 'O.erred to as -V). (Step 2). 

rrs 9 5 7 oJiTTn hTl^S ^mTney' nSu"1 £>. is now shuning down. ,h. To Subscribe, 
(Steps 514-516). If it is a ,ra " sac ™' * , SteD 518 & 524) . Correspondingly, in a Teller money 

SET 2 t?£ SSK « Anting transactions" tha, ha.e heen undertaken 

^B\^i^y«^ ^ - * « — » — * skps 5 °°- 524 ' 
^•■rxmrrod^ 
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234) c; vm m e tric Kev A 45 then encrypts the verification message with the date and time 'formation using 

„e ^^£^%™^ B '£&^ 5 

encrypted message (Step 238) to Session „ £ tne Maintain Security B 37 for message 

" fstep ^"icT An nc h£ SS'SEL •> >- -Ud through Steps 

^r^.^^^T-" •*«=• « » Ma "" a,n s8cu,i,y B 37 compa " 
issssrvs ess s^—. - -* . -«.- a — r= 

„ th. Serine r module BfStep 250). I, the discrepancy between „e two ctocKs . greater than a 
?Ss."teptT-rFig^!1ession Manage, A 31 acknowledges the message receipt and also notes the 
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start of session (Steps 256 - 258) 
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Request Withdrawal 

After a session is established between the Transaction money module 4 and T^^^^ 
noted that although the figure denotes the parties as X and Y. in the process p 

o the Teller money module 5 (Step 700). To send this request, the process Steps 2-8 are repeated, 
whSthe message is encrypted using the previous.y described cryptographic techniques. 

Validate Account Number 

Once the withdrawal request and the account number and profile are ^ ^laTam 

module 5, a procedure to validate the account number is initiated (Steps 7041 -7055). A f.ow diagram 

Server 27 An invalid signature causes the Maintain Security 37 app.icat.on to inform the Ses _s,on Vtonager 
thaMhe account profile's invalid (Step 7044), whereby Steps 500-524, F,g. 32. are followed to abort the 

transaction between the two money modules. . aoDlication 47 

If the signature test confirms a valid signature, the procedure advances to the To Ban = a PP™ n £ 
which sends the account number it has received on to the bank's computer systems (Step ,7046). An 
TnaSL recount will cause the Maintain Security application ,37 to inforrr »*• 

inactive account (Step 7048) and have the transaction aborted following steps 500-524 an account tnat 
has not been inaSfe wi.l allow the Maintain Security application 37 to check if the account profile needs to 

30 ^ TS?lSSXX 7 o^L to be recertified, the Maintain Security application 37 wil, to send the 

ctpnds it to the money module making the withdrawal request (Step 7054). 

ThrcommunTcaLn from the Teller money module 5 to the money module ufc.izes the prev^usiy 

tlZ Tts fer mone™ od y u.e 5 (Step 7055), also using Steps 2-8. The e.e ^0 message us rece.ved 
by the Maintain Security application 37 of the Teller money module 5 and acknow.edged Step 7 056. 

With the account information checked, the process returns to Step 704 of F.gure 30. The To Bank 
appSon 47 now verifies that there are sufficient funds to support the withdrawal reques (Step ,704^ 
Start funds Z prompt the return of an acknowledgement to a Transaction money modu e 4, utH.zmg 
SSST^-B to transmit the acknowledgement to its To Teller 34 application function (Steps 706- 
714) In the case of a Teller money module 5, no acknowledgement is required ^..h^riher 
4 5 m the case of a Transaction money module 4, an insufficient amount of funds w,H cause the subsenber 
} to b r prompted to enter a new amount for the withdrawal (Steps 718-720 Figure 30A). As shown by Step 

724 the newly entered amount causes the To Teller application 34 to send the new request to the To Bank 
looiication 47 (using Steps 2-8) of the Teller money module 5 to verify if there are sufficient funds to 
1 l^T^L^ele' amount, returning to Step 704 of Fig. 30. If the new ^ 's^ greyer than 

the funds on balance at the bank, the Teller money module 5 will mit.ate Steps 500 - 524 to abort the 
Jr^^^SSTfte to money modules. In the case of a Teller money module 5, the transacts ,s 
allowed to overdraw the account. 
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Referring back to F.gure 29. To Teller A 34 transfers the total of its currency notes 11 to the Te ler 
money module 5 (Step 45). If there are no notes 11 being held in the Transaction money ™^ 4 ,*£ 
tTme the withdrawal request is made, the To Teller A application 34 sends a message to the Teller money 
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m0 du,e 5 that there are no notes 11 present (Step ^^^u^L procedure described be.ow 
Electronic notes 11 are transferred between money modu.es using t P module ch00S es the 
(referring now to Figure 39). The Note D.rectory app caton 39 ^ /„ create , transfer for 

notes 11 of proper values for the transfer (Step 750) and ^ e ^ote ^ ^ ^ 

SnaTures into a pacKet to be sent to ^^J^^^^ PacKet Manager app.ication 
Steps 2-8 are utilized to transfer the packet of f^tronic :n m es application 42 

verifies the transfers appended to the certiTicaies, emu 

11 that should be sent (Step 760). . . „ n th t m0 nev modules to be aborted, using 

Any inva.id ^ have their expiration dates 

the procedure outlined in Steps 500 524 above £«P Transacti0 n money module 4 that has 

r^rnT ™> - ~- the sessions to be aborted 

using the procedures outlined in Steps 500 - ( 524 ^ ^ module 5 is accept ing 

Assuming the notes 11 have ^J«H - - .n the case y ^ ^.^ 

is updated with the new *• electronic notes 11 have been transferred 

Unsactions are posted to reflect "^^^^^ from the mone'y module, and 
appNcation B 47. Both ,„ **™»^ ^^i„ s£^^ is established between the Tel.er 

z: e ^:rrzz^ . , 9 p^ *~ * ^ «■>- 

258, Figs, 34. 34A - C. withdrawal, an account posting occurs lo reflect We request. 

^^"ppircSTr-'St «~— ™ * » - - 

illustrated in Figure 14, Step 2. 
Request Notes 

Directing, attention to Figure 40. notes 11 may be requested between Telle, money modules 5 and 
Money Generator modu„s 6 -*>««^ ^es^T*. mo "ey module 6 w«, !ssue a request 
lwa ^c^^^^ 

electronic notes 11 (Step 786). elrinei H hv thP Public Kev application 44 of the Money 

After the ^SS^^fS^S, S (Step 790). Finally, the 

transferring- electron.c notes 11. withflrawa | of electronic notes 11, the money modules will 

detailed descriptton o, tnis P'°»-J» ™£e M ^ T» TransS" moneT mil. 4 tna. is 

rrr LTseTsrs sctss sss sr. - » - - - - — 

module it is transacting with. 
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With this end of session notice received, the other money module, in this example a Teller money 
module 5 will use its Tran Log Mgr. application 36 to update its own Tran Log (Step 694). Assuming, 
however, the second money module receiving the end of session notice is not a Teller money module 5, an 
additional step of having the To Subscriber application 33 notify the subscriber of the end of the transaction 
occurrence (Step 696) will be necessary. Thereafter, the Session Manager 31 of the second money module 
in both cases will also make note of the end of the session (Step 698). 

Directing attention back to Figure 28, the process to commit is initiated first by the Transaction money 
module 4 committing its transaction with the Teller money module B 5 (Steps 690-698). The process steps 
are also applied to commit the transaction between Teller money module B 5 and the Money Generator 
module 6 (Steps 690-698). That completes the processing for one complete withdrawal of electronic 
money from an Issuing Bank 1. 

Withdrawal From A Correspondent Bank 

A withdrawal from a Correspondent Bank 2 will now be described, aided by reference to Figure 35. To 
begin, the previously described Steps 43-48 to set up a withdrawal are undertaken by a Transaction 
money module A 4, in conjunction with an Teller money module B 5. Next, Steps 190-258, used to 
establish a session, also described above, are initiated between Teller money module B 5 and Teller money 
module C 5. After the sessions have been established, the To Bank application B 47 wilt post the 
accounting transaction corresponding to the withdrawal that is going to subsequently occur (Step 900; see 
also Fig. 13, Step 1). 

As previously noted, it is contemplated that whenever a Transaction money module 4 interacts with a 
bank, both Issuing 1 and Correspondent 2. all electronic notes 11 that are stored within the Transaction 
money module 4 are removed and replaced with electronic notes 11 containing the most recent certificate. 
To perform this operation, To Transaction B 49 will check to see if there are notes 11 stored within the 
Transaction money module 4 (Steps 902-904). If there are notes 11. To Bank B 47 will post the 
appropriate accounting transactions (see accounting procedure illustrated in Figure 13; Step 2) (Step 906), 
and perform a deposit request from the Teller money module C 5 (associated with an Issuing Bank 1) to 
return the notes 11 that need to be replaced. 

For a detailed description for performing a deposit request, attention will be directed to Figure 44. Here, 
the To Teller application 34 sends a deposit request message, the amount of the deposit to be sent, the 
account number and the account profile of the account to which the notes 11 will be deposited (Step 920). 
This information is transferred to the Teller money module 5 using Steps 2-8 for sending messages, and 
then Steps 7041 -7050 (see Figure 38) are performed to validate the account profile and number. 

In the case where the depositor is a Transaction money module 4, the To Transaction application 49 of 
the Teller money module 5 will send an acknowledgement to the Transaction money module 4 that the 
transfer of notes 11 is ready to proceed (Step 924). Alternatively, if it is another Teller money module 5 that 
is making the deposit, it is the To Teller application 34 that issues the acknowledgement to the Teller 
money module 5 (Step 926). 

In either case, the acknowledgement is encrypted and transmitted using the procedure outlined in Steps 
2-8, whereby it is received by a To Teller application 34 of a depositing money module (Step 928). 

Referring back to Figure 35, once the deposit request is completed, the notes 11 are transferred from 
the Teller money module B 5 to the Teller money module C 5 using Steps 750-770, Figs. 39, 39A detailed 
above for transferring notes. Accordingly, To Bank C 47 posts the proper accounting transactions (see 
Figure 13, Step 2) to reflect this transfer of notes 11 (Step 908). In Teller money module C 5, the To Teller 
application 34 acknowledges the deposit by sending a message back to the To Teller B 34 application 
(Steps 910-912), using Steps 2-8. Naturally, the To Bank B 47 will now post its accounting transactions to 
reflect the withdrawal request it has made to Teller money module C 5 (Step 914; see also Fig. 13, Step 
3). 

After all electronic notes 11 have been removed from the Transaction money module 4 and the proper 
accounts have been posted, a withdrawal is requested of a total amount that includes both the amount 
originally requested to be withdrawn from the subscriber's bank account and the amount that was removed 
from the Transaction money module 4 to be replaced with updated electronic notes 11. 

The withdrawal request is performed between Teller money module B 5 and Teller money module C 5 
using the process Steps 700-724, Figs. 30, 30A t described above. Teller money module C 5 transacts with 
Money Generator module 6 to withdraw new electronic money and in doing so it establishes a session 
between the two modules using the process Steps 190-258, Figs. 34, 34A-C. 
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money module B 5, they are transferred to the Transaction money module A 4 using Steps 750-770. 

After Transaction money module A 4 receives the electronic notes 11, it must finalize the transaction by 
committing Teller money module B 5 to Transaction money module A 4 using Steps 690-698. Likewise, 
Teller money module B 5 must commit to the Money Generator module 6 using the same Steps 690-698. 

Deposit To A Correspondent Bank 

Figure 45 illustrates the process flow for a deposit at a Correspondent Bank. In depositing to a 
Correspondent Bank 2, the deposit set up described in Steps 398 through 414 are repeated in the first 
stage of the transaction. From there the To Transaction B 49 tests to see if the deposit is less than the total 
amount of electronic notes 11 that have been withdrawn in the deposit set up procedures that were just 
processed (Step 440). 

In the case where all the electronic notes 11 stored in the Transaction money module 4 are equal to the 
amount of notes 11 to be deposited, then To Transaction B 49 sends a deposit acknowledgement back to 
the Transaction money module 4 (Step 444), using Steps 2-8 to send the message from the Teller money 
module B 5 to Transaction money module A 4. 

On the Transaction money module 4 side, the To Teller 34 application receives the acknowledgement 
(Step 446) and uses Steps 690 - 698 to commit the transaction with Teller money module B 5. The 
Transaction money module 4 is now finished and removed from the process. The f.nalization of the deposit 
provides for the account posting transactions to be made by the To Bank application 47 (Step 448). See 
Figure 1 1 , Step 1 for the accounting transactions. 

A sessions is now established between the Teller money module B 5 and Teller money module C 5 
using Steps 190-258. 

Teller money module B 5 issues a request to make a deposit to the Teller money module C 5 by using 
process Steps 780 - 792. The To Bank B 47 then posts the accounting transactions (Step 450; see also Fig. 

' Notes 11 are now transferred from the Correspondent Bank B 2 to the Issuing Bank C 1 using Steps 
750 - 770; the Issuing Bank C 1 posts the corresponding accounting transactions (Step 452; see also Fig. 
11, Step 2). The To Teller C 34 responds by sending the deposit acknowledgement (Step 454) using Steps 
30 2 - 8 to To Teller application 34 of Teller money module B 5 (Fig. 45A, Step 456). 

Here again, the deposit is checked to see if it is less than the amount of electronic notes 11 that have 
been removed earlier, and when it is not, the withdrawal is completed with the process Steps 690-698, Fig. 
41, to commit Teller money module B 5 to Teller money module C 5. 

A deposit request that is less than the amount of notes 11 that are withdrawn requires account updating 
(Step 460* see also Fig. 11, Step 3), and new notes 11 to replace the additional notes 11 that were taken. 
Accordingly, a withdrawal request following the process Steps of 920-928 from Teller money module B 5 
to Teller money module C 5 is made to provide these new electronic notes 11. 

Teller money module C 5 must first establish a session with the Money Generator module 6, using the 
process Steps 190-258. The new electronic notes 11 are requested by the Teller money module C 5 from 
the Money Generator module 6 following process Steps 780-792, which are then transferred to the Teller 
money module C 5 using Steps 750 - 770 to transfer notes 11 between money modules. 

This transfer of electronic notes 11 to the Teller money module C 5 requires that accounting 
transactions be posted by the To Bank application C 47 (Step 462, Fig. 45B; see also Fig. 11, Step 3). 

From there, the notes 11 are transferred from the Issuing Bank's 1 Teller money module C 5 to the 
Correspondent Bank's 2 Teller money module B 5 and to the Transaction money module 4 by using Steps 
750-770 for transferring notes 11. Thereafter, each money module must commit to the money module with 
which it has established a session. Thus, Transaction money module A 4 commits to Teller money module 
B 5, Teller money module B 5 subsequently commits to Teller money module C 5, which then commits to 
the Money Generator module 6. All three of these commitment transactions use process Steps 690-698 
so above. 

Subscriber To Subscriber Payment 

Figure 36 illustrates the process flow for a payment transaction from one Transaction money module 4 
to another. In this example of a preferred embodiment, Alice (or a hypothetical payor corporation, is 
denoted "A" in Figure 36) will agree to pay Bob (or a hypothetical payee corporation, is denoted "B" in 
Figure 36) a specific amount of electronic money (Step 800). Both Alice and Bob sign on to their respective 
Transaction money modules 4 using the process Steps 10-42 described above. Through the To Sub- 
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n ^1S 6 mS-"^^ Alice, Transaction money 

TransaSon money module 4 established communications. From there a session ,s established, as 
Transacuon y transacting between any two money modules. 

^^h a sessTon esUbS S£?o Subscriber A 33 prompts the subscriber to enter the amount of payment 

^n^red Rq 3 S tep 820). The amount entered by type (currency or credit) .s now compared by 
NotT Directory A 39 to the balance of the value of the electronic money ^ ^^^^ 

iNoie uu^i y onffirient funds available to permit the transaction to proceed (Step B2<>). 

^",^7; <^ 0 , «0 action dear.d (Stops a*.-**,,, prompts th, su b.«*.r .g™ lor a 

th^n riocide whether to accept or reject the amount to be transferred (Step 832). 
^ Tsol Z ££T the negative, then Pay/Exchange B 35 wil. send a 

money module A 4 using Steps 2-8. that the amount to be transferred is incorrect (Step 834). the process 

• * ~~ 4^ ct art AOft Fin ^6 to ororriDt Alice for a new amount to be entered. 
393 WIT n Bo Z^'^ J££T* Step 832. Pay/ Exchange B 35 wil. send an acknowledgement 

wnen dod re^u _ Transaction money module A 4, the 

~r bTcoZld ViSSSSS A deceive the acknowledgment sent by Transaction 

30 m0 Zh m Sfac B k nVwtd P g Sfent received. Pay/Exchange A 35 wi.. send the amount desired to be trans - 
( Honev Holder 38 (Step 838) so that the electronic notes 11 may be transferred using Steps 

\Z%V w^e^Z compLted the two Transaction money modu.es 4 must commit to the transfer 
using Step 690-698 described above. The communication link between the two transact.cn modules may 

35 now be terminated. 

Subscriber to Subscriber Foreign Exchange 

Referrina to Figure 46. the process flow for an exchange of foreign currencies between two Transaction 
money modu.es 4 wi Low be Hlustrated. In this example Alice (or a hypothetical corporate, denoted A 
ITESrTS " 48A) bq«* to exchange dollars for pounds with Bob (or a hypothetica. corporate denoted 
"B" ?n Figures 46 - 46A). The exchange rate that they have agreed to wi.. be a ratio of dol.ars to pounds 

<Ste Alfce°begins by signing on to her Transaction money module 4 (using Steps 10-42 described above) 
whi.e B^sig s on'toL Transact money module 4 (using Steps 10-42) Thereafter 
33 Locations of both Transaction money modules 4 prompt the respective users to select a type of 
transac ^ on (Steps 302 - 303). .n this example. Alice and Bob agree to exchange her do..ars for h,s pounds. 

Bv Sque2ng the foreign exchange transaction, Session Manager A 31 wil. estab.ish a communications 
.ink w^th Sesston Manager B 31 (Steps 306. 307) so that a session may be established between the *vo 
"rnodurusing Iteps 190-258. A.ice is then prompted by To Subscr^r A , 33 for the amount of 
dollars she will sell and the exchange rate that she will use in the transaction (Step 308). 
M tSA 35 receives the input (Step 310) and Note Directory A 39 checks for sufficient funds 
by coXaring "he amount requested to the amount of va.ue contained in the Transaction |"«ijyr^4 
(Itep 312). I insufficient funds condition wil. cause the To Subscriber A 33 to send "^"TlSS 
messaoe o Alice and prompt the subscriber to select another amount of dollars and exchange rate (Steps 
STSTw en new^etections are entered, the process f.ow returns to Step 312 and I continues from 
there. If Alice does not se.ect a new amount, the session is dissolved using abort transaction Steps 500 
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When the funds are sufficient to meet the amount requested, the Pay/Exchange A 35 sends the amount 
of the dollars and the proposed dollar/pound exchange rate (Step 316) to the To Subscriber application 33 
of Transaction money module B 4 using the Steps 2-8. (See Figure 46A). At this point, To Subscriber B 33 
prompts Bob with the amount and rate proposed by Alice, to determine if the values are what Bob will 

agree to exchange (Step 322). 

The Pay/Exchange B 35 receives the dollar amount and the rate that is proposed by AI.ce and if the 
amount and rate are not agreed to by Bob, Pay/Exchange B 35 will send a message indicating that the 
value or exchange rate is incorrect (Step 326), through the Steps of 2-8 for sending messages. To 
Subscriber A 33 prompts Alice for the dollar amount and exchange rate over again (Step 327). Entry of new 
values returns the process to Step 310 for continuation, see Fig. 46, while the lack of new values entered 
causes the abort transaction process of Steps 500 - 524 to be initiated. 

If the amount and rate are agreed to by Bob, Pay/Exchange B 35 will calculate the equivalent amount in 
pounds, based on the rate provided (not shown), and then initiate the step of having Note Directory B 39 
check to see that Transaction money module B 4 contains sufficient funds to fulfill the exchange (Step 
323) When the funds in Transaction money module B 4 are insufficient to meet the exchange, 
Pay/Exchange B 35 sends a message to Alice of insufficient funds (Step 325) using Steps 2-8. The 
process flow returns to Step 327. 

Proceeding with the case in which sufficient funds do exist in Transaction money module B 4, 
Pay/Exchange B 35 will send an acknowledgement using Steps 2-8 to Transaction money module A 4 - 
(Step 329) After receiving this acknowledgement, Pay/Exchange A 35 sends the amount of dollars 
requested to its corresponding Money Holder 38 application in Step 330. The dollars are transferred from 
Alice to Bob via the Steps 750-770 described above for transferring notes 11. 

Pay/Exchange B 35 receives the notes 11 and then transfers the amount of pounds to its Money Holder 
38 application (Step 331). From there, the electronic pounds are transferred to Alice using the transfer notes 
process described in Steps 750-770. To record this exchange, Transaction money module A 4 commits 
with Transaction money module B 4 by using process Steps 690-698 described above. With a sat.sfactory 
exchange, the communications link between the two Transaction money modules may now be terminated. 

Foreign Exchange At An Issuing Bank 

Turning attention now to Figure 48, if a subscriber were to exchange his/her dollars for pounds with an 
Issuing Bank 1 instead of with a subscriber, the following process is followed. 

Subscriber A sets up the foreign exchange transaction by signing on to his/her Transaction money 
module 4 (see Fig. 47Z) using Steps 10-42 described above. To Subscriber A 33 prompts the subscriber 
35 for the transaction desired (Step 334), and in this example, the subscriber chooses the dollar/pound 
exchange, and the amount of dollars the subscriber will exchange. It is anticipated that the choice of the 
bank to transact with may be an option offered to the subscriber (Step 336). 

The Note Directory A 39 checks for a sufficient balance to complete the request (Step 338). An 
insufficient balance permits the subscriber to again enter the amount he/she will exchange (Step 340- 
40 342), whereby Session Manager A 31 will terminate the transaction (Step 345) if no new amount is entered. 
Entry of a new amount returns the process to Step 338 to check for sufficient funds to meet the new 
request. When the funds are sufficient for the exchange request, a Network 25 sign -on using Steps 50- 
168 is commenced. 

After the Network 25 sign -on, the Network 25 checks if a bank or financial institution has been 
45 selected (Step 346). If a bank or financial institution was not chosen earlier, To Teller A 34 must prompt the 
Network Server 26, through Session Manager A 31, for a list of banks or financial institutions that will 
provide the exchange (Steps 348-350). The Network Server 26 sends the list (along with rates) to the 
subscriber through the To Teller A 34 and To Subscriber A 33 applications (Steps 352-356). 

After prompting (Step 357, Fig. 47 A), the subscriber chooses a bank or financial institution, or ends the 
so transaction (Step 359). When a bank or financial institution is chosen, a session is established with the 
Teller money module 5 chosen using Steps 190-258 described above. After a session is established, To 
Teller A 34 sends the amount of dollars to be exchanged for pounds (Step 360) using Steps 2-8 for 
encrypting and transmitting a message. 

To ensure that the subscriber still wants to proceed with the exchange, To Transaction B 49 sends the 
55 current exchange rate to the subscriber using process Steps 2 - 8 (Step 362). At this point, To Subscriber A 
33 prompts the subscriber with the bank's exchange rate and if the subscriber does not wish to proceed, 
the transaction is aborted by following Steps 500-524 (Steps 364-366). If the transaction is to proceed, 
the dollars are transferred from Transaction money module A 4 to Teller money module B 5 using Steps 
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750 - 770 described herein. e transactjon is accom p, ished , the proper 

Returning to F.gure 48, once the set .up > or in « * ref|ect ^ d0 „ ars that 

accounting transactions are money P module B 5 and a Money 

have just been transferred .A sess.on ^.s r ts the proper pound note s 11 

S^C^iT^ are returned from the Money Generator moduie 6 to the 

. 2> The notes 11 are transferred to the Transaction money module A 4 through 

see ^^^^^^Si'ie exchange. Transaction money module A 4 commits to Teller 
money rrwjdufe B 5 who subseTuSy commits to'the Money Generator module 6 using process Steps 
690 - 698. 

Foreign Exchange At A Correspondent Bank 

The foreion exchange with a Correspondent Bank 2 is described with the aid of Figure 49. Initially the 

S ZZZ^To^ZellyZ money ^ B 5 (Step 372). Thereafter, Te.ler money module 
B 5 wM^s^ablfsrTa session with Teller money module C 5 at an issuing Bank 1. by performing process 

^ A withdrawal is requested by Teller money module B 5 to Teller money modu.e C5^9I^ 
qtPos 920-928 described above. To obtain the notes 11 for the request. Teller money module C 5 must 
g^them from 8 a Money Generator modu.e 6. Accordingly, a session is ^^^^^J™ 
modules via Steps 190-258. and the notes 11 are requested following process Steps 780 792 outlined 

ab ° V The Money Generator module 6 will create the notes 11 requested and transfer them to Teller money 
m nnll C 5 usino orocess Steps 750 - 770. This is followed by a posting to the proper accounts m the 
San -s sys'emT(Step 374) see Figure 16, Step 3 for accounting transactions). The notes 11 are now 
SSerirtfr^ Telle? money module C to Transaction money modu.e A 4 via Te.ler money module B 5 
using or each transfer the process Steps 750 - 770. Finally, all the sessions must be ~«^J d 
Transaction money module A 4 commits to Teller money module B 5 who ,n turn commits to Teller money 
m 0 re C 5 using Steps 690 - 698. TeHer money modu.e C 5 commits to the Honey Generator module 6 to 
complete the exchange of dollars for pounds. 

Updating Notes, Certificate 

As mentioned above, it is anticipated that the date of expiration of a note, used as a security measure 
may exSre while it is stored in a Transaction money module 4. If this occurs, the holder of expired notes 11 
40 S nofbe able to transfer them to another Transaction money module 4 but the holder may deposit them 
or exchange them for new notes 11 by transacting with a participating bank or f.nanc.al institution. 

AddWonaHy if the certificate associated with a particular Transaction money module 4 expires the 
subscribe? must sign on the Network 25 to update the certificate in order to transact w.th another 
T^nsactfon money module 4. The fo.lowing is a description of the process flow for updating an exp.red 

45 ^SningTttfe CofVigure 50. a subscriber signs on to the Transaction money modu.e 4 using the 
Steps 10 - 42 described above, and is prompted by To Subscriber A 33 to select a transaction (Step 570). 
AS seLthTg the transaction for "updating" (Step 572). a sign-on to the Network 25 ,s performed us.ng 
Steps 50 -T 6 8 The sign -on to the Network 25 will perform the updating of the certificate, as described 

50 ab 7or P d^g tS no^ 3 t 3 he" 3 Se A ssion Manager A 31 sends the update notes request to the Network 
25 (Step 574); the Network Server 26 responds by sending the selected bank identf.er back to the 
fJSL money modu.e 4 (Step 576). Now, a session may be established between , the Transaction 
money module A 4 and the Teller money module B 5 of the bank selected, us.ng Steps 190 ' "25* 

Once the session is established, To Teller A 34 sends the request to update notes 11 (Step 578) usmg 
the message sending routine in Steps 2 -8. To Transactor B 32 responds. Fig. 50A, w, h an acknowledge- 
ment (Step 580) sent using Steps 2-8. Transaction money modu.e A 4 can now transfer the expired I notes 
Tl to Teller money module B 5 using Steps 750-770. Thereafter, the correspond^ accountmg (see 
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Figure ?4, Step 1) is performed in the bank's records (Step 582), and a session is established between 
Teller money module B 5 and the Money Generator module 6 through Steps 1 90 - 258. 

The request notes routine of Steps 780-792 is then performed. The Money Generator module 6 sends 
the requested notes 11 via Steps 750 - 770, and updates the accounts at the bank (Step 584; see also F,g. 
5 24, Step 2). Teller money module B 5 takes the updated notes 11 and passes them to Transact.on money 
module A 4 using the same Steps 750 - 770. 

Now that the notes 11 have been updated in the Transaction money module 4, the sessions are 
completed by having Transaction money module A 4 commit to Teller money module B 5, and having 
Teller money module B 5 then commit the transaction with the Honey Generator module 6. F.nally, both 
io committing routines are performed using Steps 690 - 698 described above. 

The above described process flows illustrate the capability of the invention to provide an improved 
system for exchanging electronic representations of economic value, while avoiding the inherent lim.tations 
of paper based monetary systems. 

Operation of the invention has been described primarily with currency notes and credit notes that can 
,s be used by subscribers in the same processes. It will be understood that the described system can also be 
adapted to other monetary instruments. For example, personal and corporate checks and bank drafts could 
be provided by enhancing several of the Transactor applications. More complicated multiparty payment 
processes such as letters of credit and banker's acceptances could also be provided with appropriate 
changes to the system. It may also be possible to adapt the system of the invention to provide corporate 
20 financial obligations such as commercial paper. 

Moreover although the invention has been described in detail with particular reference to a preferred 
embodiment thereof, it should be understood that the invention is capable of other and different embodi - 
ments and its details are capable of modifications in various obvious respects. As is readily apparent to 
those skilled in the art, variations and modifications can be- affected while remaining within the spmt and 
25 scope of the invention. Accordingly, the foregoing disclosure, description, and figures are for illustrative 
purposes only, and do not in any way limit the invention, which is defined only by the claims. 

Claims 

1. An electronic monetary system for providing transactions utilizing electronic representations of currency 
backed by demand deposits in a bank comprising: 

means for generating said electronic representations of currency; 
teller means for issuing and distributing said electronic representations of currency; 
transacting means for storing, and for transferring said electronic representations of currency 
between other transacting means and between said transacting means and said teller means. 

2. An electronic monetary system for providing transactions utilizing electronic representations of credit 
authorizations comprising: 

means for generating said electronic representations of credit; 
teller means for issuing and distributing said electronic representations of credit; 
transaction means for storing, and for transferring said electronic representations of credit between 
other transacting means and between said transacting means and said teller means. 

3. An electronic monetary system according to claim 1 or claim 2 further comprising a means for 
45 maintaining the security and integrity of said electronic monetary system. 

4. An electronic monetary system according to claim 1 or claim 2 further comprising a means for 
providing a communication network between said generating means, said teller means, said transacting 
means, and said security means. 

50 . 

I 5. An electronic monetary system according to claim 1 or claim 2 further comprising a means for 
| maintaining and processing account data files for storing records of said electronic representations of 

i currency or credit issued by said generating means and records of said electronic representations of 

J currency or credit transferred by said transacting means to said teller means. 
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An electronic monetary system according to claim 3 wherein said security means further comprises a 
time limit on the transferability of said electronic representations of credit and said electronic repre 
sentations of currency among said transacting means. 
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7 An electronic monetary system according to claim 3 wherein said generating means, said teller means 
and S ZmZqLL each comprise an individual identifier, and said means for maintaining the 
^tZ TsTZ^o monetary system further comprises a certification mean, ^for proving a 
unique certificate of said identifier of each of said generating means. said teller means and sa.d 

transacting means. 

ft An electronic monetary system according to claim 7 wherein said certificate further comprises a time 
m^ZJZiZm * ~id 9enerating means, said tel.er means or other of sa.d transacts 

means. 

q An electronic monetary system according to claim 1 or claim 2 wherein said generating means further 
comprises a pubt key" digital forming means for forming a digital signature on said electronic 
representations of currency or said electronic representations of credit. 

10 An electronic monetary system according to claim 1 or claim 2 wherein said teller means further 
compHses a public key digital forming means for forming a digital signature on sa.d electrons 
representations of currency or said electronic representations of credit. 

11 An electronic monetary system according to claim 1 or claim 2 wherein said transacting means further 
prises a pubiic key" digital forming means for forming a digital signature on said electronic 
representations of currency or said electronic representations of credit. 

12 An electronic monetary system according to claim 1 or claim 2 wherein said electronic representations 
oTcurrency or said electronic representations of credit are undeniably acceptable as econom.c value. 

13 An electronic monetary system according to claim 1 or claim 2 wherein said electronic representations 
of currency or said electronic representations of credit are confutable and transferable in values less 
than or equal to their original economic value when generated. 

30 14. An electronic monetary system according to claim 13 wherein said electronic representation of credit is 
transferable only one time by said transacting means. 

15 An electronic monetary system according to claim 1 or claim 2 wherein said electronic representations 
of currency or said electronic representations of credit further comprise indicia of 
35 (1) whether said representation is a currency or a credit representation. 

(2) its said time limit of transferability, and 

(3) its economic value. 

16. An electronic monetary system according to claim 15 wherein said indicia further comprise indicia of 
40 (1) said certificates of said other transacting means, 

(2) said certificates of said teller means, and 

(3) said certificate of said generating means. 

17. An electronic monetary system according to claim 16 wherein said indicia further comprise indicia of 
4 5 (1 ) a digital signature of said generating means, 

(2) a digital signature of said teller means, and 

(3) a digital signatures of said other transacting means. 

18. An electronic monetary system according to claim 1 or claim 2 wherein said generating means, said 
teller means, and said transacting means are each comprised of a programmable processing dev.ce 
contained in a tamper -proof housing. 

19. An electronic monetary system according to claim 18 wherein said generating means, said teller 
means, and said transacting means are configured to perform as a modular co- processor of a general 

55 purpose computer. 

20. An electronic monetary system according to claim 18 wherein each of said programmable processing 
devices further comprises a list of other offending programmable processing devices. 
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21. An electronic monetary system according to claim 1 or claim 2 further comprising a means for clearing 
said electronic representations of credit and currency issued by more than one bank. 

22. An electronic monetary system according to claim 1 or claim 2 wherein said financial facilities further 
comprise an accounting structure to monitor the distribution of said electronic representations of 
currency or said electronic representations of credit and each financial facility s obl.gat.on after any 
financial transaction. 

23. An electronic monetary system according to claim 18 wherein said programmable processing device in 
said transacting means further comprises separate lists for accounts associated with the owner of sa.d 
transacting means that are held at each of said different financial facilities. 

24. An electronic monetary system according to claim 23 wherein each of said list of accounts further 
comprises a digital signature of the financial facility maintaining said accounts, to prov.de security from 
unauthorized access of said accounts. 

25 An electronic monetary system according to claim 1 or claim 2 wherein said generating means is 
configured to generate said electronic representations of currency or said electronic representations of 
credit for a plurality of monetary units. 

26. An electronic monetary system according to claim 18 wherein each of said programmable processing 
devices can be personally coded to prohibit use by unauthorized persons, such coding being 
performed by an individual that does not have any relationship with any of said financial faclit.es, and 
whose identity remains anonymous. 
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27. A monetary system using electronic representations of money and including at least one financial 
facility and subscribers served by said facility, said system comprising: 

a plurality of subscriber processors, each adapted to contain said electronic representat.ons in the 
form of machine readable digital objects containing data indicative of the monetary value represented 
30 and the current validity of said representations; 

processing means operated by said financial facility and capable of communicating with said 
subscriber processors for the deposit in said facility of representations stored in sa.d subscriber 
processors, or the withdrawal or representations from said facility to said subscriber processors; 

said subscriber processors also including communication and processing functions enabling 
35 exchange of said representations between subscriber processors. 

28. A system according to claim 27 in which said money representations are configured to be functionally 
equivalent to bank notes. 

40 29. A system according to claim 27 including a certification source enabling the processing of said 
representations to indicate their validity. 

30. A system according to claim 27 in which there are a plurality of said financial facilities and a clearing 
facility for clearing transactions among said financial facilities and said subscriber processors. 

31. A system according to claim 27 in which said data stored in said subscriber processors includes data 
representations for ascertaining the status of said representations. 

32. A system according to claim 27 in which said electronic representations of money stored in said 
subscriber processors are replaced with updated representations during transactions with said financial 
facility. 

33. A monetary system using electronic media to securely and reliably exchange economic value, said 
monetary system comprising: 

electronic representations of credit authorizations and electronic representations of currency 

backed by demand deposits in a bank; 

means for generating said electronic representations of credit and said electronic representations of 

currency; 

40 
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teller means coup.ed to said generating means for issuing, distributing, and accepting said 
electronic representations of credit anc J currency; and represe ntation S of credit and 

cuf ^^^ZZZ^^^^ transacting means and said teller means. 
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75 



20 



25 



30 



35 



ZHSST^ to maintain the security and integrity of said monetary system. 

means. 

Mer of each of said generating means, said teller means and sa.d transact.ng means, 
said security means. 

values less than or equal to their original economic value. 
41. A monetary system according to claim 40 wherein said electronic representation of credit is transfer- 
able only one time by said transacting means. 



currency. 
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currency. 

^ a mnnptarv svstem accordinq to claim 33 wherein said transacting means further comprises a public 
^ ^^^r^^^ a digital signature on said e,ectronic representations of cred,t and 

currency. 

45. A monetary system according to claim 41 wherein said electronic representations of credit and 

currency comprise indicia of 

(1) whether said representation is a currency or a credit representation, 

(2) its said time iimit of transferability, 

(3) its economic value, 

(4) said digital signature of said generating means, 

(5) said digital signatures of said teller means, 

(6) said digital signatures of other transacting means, 

(7) said certificates of other transacting means, 

(8) said certificates of said teller means, 

(9) said certificate of said generating means, and 
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(10) an identifier of said electronic representation of currency or credit. 

46. A monetary system according to claim 33 wherein said generating means, said teller means and said 
transacting means are each comprised of a programmable processing device contained m a tamper 
5 proof housing. 

47 A monetary system according to claim 46 wherein said generating means, said teller means, and said 
transacting means are configured to perform as a modular co- processor of a computer. 

48. A monetary system according to claim 33 further comprising a means for clearing said electronic 
representations of credit and currency issued by more than one bank. 

49 A method of using electronic representations of currency or electronic representations of credit 
' provided by at least one financial facility having a means for generating said electronic representat.ons 

and a teller means for issuing and accepting said electronic representations and serving subscribers of 
said facility, comprising the steps of: 

(1) generating said electronic representations of currency backed by demand deposits or generating 
said electronic representations of credit authorizations; 

(2) issuing to said subscribers and accepting from said subscribers electronic representat.ons of 
currency or credit, wherein the issuance and acceptance is performed by said teller means at said 
financial facility; and 

(3) providing said subscribers with a transacting means for accepting said issued electronic 
representations of currency or credit, and for transferring said electronic representations of currency 
or credit to both other subscribers having said transacting means, and to said teller means. 

50 The method of claim 49 further comprising the step of digitally signing said electronic representations 
of currency or credit to provide authenticity and security from duplication or modification. 

51. The method of claim 50 further comprising the step of limiting the time period that said electronic 
representations of currency or credit may be transferred among said transacting means. 

52. The method of claim 51 further comprising the step of removing all of said electronic representations of 
currency stored in said transacting means whenever said transacting means transacts with sa.d 
financial facility, the step of generating new electronic representations of currency havmg a renewed 
time limit on transferability, and the step of replacing said original electronic representations of currency 
in said transacting means with said new electronic representations of currency. 

53. The method of claim 51 further comprising the step of removing all non - transferred electronic 
representations of credit authorizations stored in said transacting means only whenever sa.d transacting 

40 means transacts with the financial facility issuing said electronic representations of credit, the step of 
generating new electronic representations of credit having a renewed time limit on transferability, and 
the step of replacing said original electronic representations of credit in said transacting means with 
said new electronic representations of credit. 

45 54. The method of claim 49 further comprising the steps of clearing, and maintaining records of said 
electronic representations of currency or credit issued by said financial facilities. 

55. The method of claim 49 further comprising the step of providing an identifier unique to each of said 
generating means, said teller means and said transacting means. 

56. The method of claim 55 further comprising the step of certifying for a limited period of time the validity 
of said identifier of each of said generating means, said teller means and said transacting means. 
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57 The method of claim 56 further comprising the step of providing a list of any offending teller means, 
generating means, or transacting means to each of said generating means, said teller means and sa.d 
transacting means. 
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58 The method of claim 49 further comprising the step of generating said electronic representations of 
credit and currency for a plurality of different monetary units. 

59 The method of claim 49 further comprising the step of providing an accounting structure at said 
lncTaT?aci.il to monitor the distribution of said electronic representations of currency or credit, and 
each financial facility's obligation after any financial transaction. 

The method of claim 59 further comprising the step of storing in said transacting means separate lists 
for accounts associated with said subscriber at each of said financial facilities. 

The method of claim 60 further comprising the step of digitally signing each of said list of bank 
Iccount^th the digita. signature of the corresponding financial faci.ity. to provide security from 
unauthorized access of said accounts. 

The method of claim 55 further comprising the step of maintaining records of transactions undertaken 
^saTd geneSting means, said te.ler means and said transacting means and storing said records with n 
ir^aid reactive „ mean . ™ = ^T^^^VZ 

electronic representation of currency or credit transferred. 

ftt The method of claim 62 further comprising the step of maintaining copies of said electronic repre- 
lenta'ot of currX and credit issued at said financial faci.ities. and the step of updtf.no said copies 
upon transacting with any of said transacting means. 

Rd The method of claim 63 further comprising the step of reconciling said copies of electronic repre- 
Inta«o?s of currLTy and credit with'e.ectronic representations of currency and credit that have been 

cleared in said financial facilities. 

Thei mpthod of claim 64 further comprising the steps of: 

Ousting records of individua. transactions that have occurred among said transacting means to a 

( 2 Tsu?mS 9 sairrords of individual transactions stored in said storage means to said financial 
SaciHttes when said electronic representations of currency or credit are stored in a transacts means 

7?^™^?***" transactions among said transacting means with records 
produced by said reconciliation of said electronic representations of currency and credit to deter - 
mTe the tL value of said electronic representations of currency and credit stored .n said 
transacting means that may be lost or stolen, for accurate replacement of said value lost. 

40 66. The method of claim 49 further comprising the step of providing a communication network, linking 
together said financial facilities and said transacting means. 
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FIG. 4 
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FIG. 5 
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FIG. 6 
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FIG. 10 
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FIG. 38 A 
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FIG. 45 
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FIG. 46A 
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FIG. 47 
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FIG. 47A 
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